Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,004 detections
Filters
Last updated
All Time
Detection languages
1,442
479
390
321
192
Contributors
650
521
286
272
264
Categories
20,443
11,831
5,875
5,151
4,864
3,004
Platforms
1,199
673
623
512
218
Products / Services
880
726
311
257
229
MITRE Techniques
1,661
1,109
905
468
464
CVEs
6
5
5
5
5
IDS Classtypes
49
13
6
3
2
IDS Protocols
40
31
1
This rule detects when an AWS Config Service is modified, stopped, or deleted. Specifically, it looks for CloudTrail events indicating actions such as stopping or deleting a configuration recorder, deleting a delivery channel, or putting (creating/updating) a delivery channel or configuration recorder. These actions can be indicative of an adversary attempting to impair defenses by disabling or modifying cloud logging capabilities.
This rule identifies when a custom administrator role is created within Google Workspace. Monitoring such events is crucial for security teams to detect and prevent unauthorized access to data that could result from malicious or accidental configuration of administrator privileges.
This rule detects when an AWS account attempts to leave an AWS organization or is removed from an AWS organization. This activity can indicate an adversary attempting to evade detection or disrupt cloud infrastructure by isolating an account from central management and security policies.
This rule identifies when a new application from the Google Workspace Marketplace is added to a Google Workspace organization. Installing certain third-party applications can introduce security risks such as data exfiltration, data leakage, or an expanded attack surface for the organization.
This rule identifies when an external user account is added to a group within Google Workspace. This detection helps security teams monitor for unauthorized or unexpected additions of external users to internal groups, which could lead to unauthorized access to sensitive data or resources. The rule works by comparing the domain of the group with the domain of the user being added; if they differ, it indicates an external user is being added.
This rule identifies when a Google Workspace user account is moved between Organizational Units (OUs). This activity can be a legitimate administrative action, but it can also be used by an attacker to move a compromised account to an OU with different policies, potentially granting them more privileges or evading existing security controls. For example, an attacker might move an account to an OU with less stringent multi-factor authentication requirements or different access policies to sensitive data.
This rule detects when an Entra ID application has a significant increase in the number of assigned permissions within a short timeframe (5 minutes). This could indicate a "greedy permission grab" by an attacker attempting to escalate privileges or gain broader access to resources. The rule specifically looks for an increase of more than 8 permissions compared to the previous state. It does not compare the specific permissions, only the count.
Detects when an AWS IAM user creates an AWS Access Key for programmatic calls. This action can be used by adversaries to establish persistence or escalate privileges within an AWS environment.
This rule detects when a single user disables multiple Google Cloud Platform (GCP) Service APIs within a short period (1 hour). Specifically, it triggers if a user performs more than 5 'DisableService' actions on 'serviceusage.googleapis.com' within an hour. This activity could indicate an attempt to disrupt cloud services or evade detection by disabling security-related APIs.
This rule identifies when multi-factor authentication (MFA) is disabled for a Google Workspace organization. This change can weaken the organization's security posture by removing an important layer of defense against unauthorized access. Security teams should monitor for such changes to prevent potential account compromise.
This rule identifies when the password policy configuration is changed within Google Workspace. Monitoring these changes is crucial for security teams to detect potential weakening of the organization's security posture, which could be exploited by adversaries to maintain or elevate access.
This rule detects an excessive number of 'AccessDenied' events within a one-hour timeframe originating from a single AWS IAM user. This behavior can indicate an adversary attempting to discover cloud infrastructure and resources by making numerous API calls that they do not have permissions for. The rule specifically looks for more than 5 'AccessDenied' events, involving more than one target application and more than one product event type, from the same user within an hour.
This rule detects when an AWS S3 bucket's Access Control List (ACL) is modified to make the bucket publicly accessible. Specifically, it looks for `PutBucketAcl` events in AWS CloudTrail where the grantee URI is set to either "AuthenticatedUsers" (meaning any AWS user can access it) or "AllUsers" (meaning anyone on the internet can access it). This action indicates a potential misconfiguration or malicious activity leading to data exposure.
Identifies when a user deletes multiple files from Google Drive within a one-hour period. This activity may indicate an attempt at data destruction or an insider threat activity.
This rule detects an excessive number of successful AWS API calls related to discovery activities (e.g., Describe*, List*, Get*) originating from a single IAM user within a 5-minute timeframe. This behavior can indicate an adversary attempting to map out the cloud environment after gaining initial access.
This rule identifies when a user account is unsuspended within Google Workspace. Unsuspending an account can be a legitimate administrative action, but it can also indicate an adversary reactivating a previously disabled account to regain access or enable further malicious activity. Monitoring this activity is crucial for detecting potential account takeover or persistence mechanisms.
Detects when principals are exempted from GCP Cloud Audit logs at either the project or organization level. This action can significantly impair an organization's ability to monitor security events and maintain compliance, as audit logs are crucial for detecting malicious activity and ensuring accountability. The rule specifically looks for 'SetIamPolicy' events targeting 'cloudresourcemanager.googleapis.com' where audit log exemptions are added for 'allServices'.
This rule detects when free Google email addresses (gmail.com, googlemail.com, or googlegroups.com) are added to an IAM policy in Google Cloud Platform. This activity is suspicious as it could indicate an attempt by an attacker to establish persistence or escalate privileges by granting access to an external, potentially untraceable, account.
This rule identifies when a Google Workspace user transfers the ownership of a file within Google Drive. This activity is logged as a 'CREATE_DATA_TRANSFER_REQUEST' event in the Google Workspace admin logs, specifically categorized under 'USER_SETTINGS'. This could indicate an attempt to move sensitive data to a different account, potentially for exfiltration or to obscure ownership.
This rule detects when a Google Cloud Workload Identity Pool is either disabled or deleted. Workload Identity Pools are used to manage external identities (e.g., from AWS, Azure, or on-premises identity providers) that need to access Google Cloud resources. Disabling or deleting a Workload Identity Pool will immediately revoke access for all federated identities associated with that pool, potentially leading to a denial of service for legitimate users or indicating an attempt by an attacker to disrupt operations or remove traces of their access. The rule specifically looks for the 'google.iam.v1.WorkloadIdentityPools.DeleteWorkloadIdentityPool' event or an 'google.iam.v1.WorkloadIdentityPools.UpdateWorkloadIdentityPool' event where the 'req_identityPool_disabled' attribute is set to 'true'.
This rule detects when a new service account key is either created within a monitored Google Cloud project or uploaded to it. This activity is significant because service account keys grant programmatic access to Google Cloud resources and can be used for persistence by adversaries if compromised or maliciously created.
Page 137 of 144