Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
461 detections
Filters
Last updated
All Time
Detection languages
134
111
68
41
32
Contributors
136
63
56
49
29
Categories
264
153
62
60
59
Platforms
39,936
7,266
6,537
3,866
3,647
461
Products / Services
260
63
57
52
51
MITRE Techniques
148
103
61
58
58
CVEs
3
2
2
1
1
IDS Classtypes
7
5
5
4
3
IDS Protocols
27
This rule detects unsuccessful attempts by human users to delete objects from Google Cloud Storage buckets that are protected by bucket-level retention policies. By filtering out service accounts, the rule specifically focuses on non-automated, human-initiated actions that violate data retention requirements.
This rule detects instances where a Google Cloud Platform (GCP) identity attempts to grant themselves highly privileged IAM roles at the project level. It monitors 'SetIamPolicy' events in GCP audit logs, filtering for activities where the actor (user) is included in the set of members receiving high-privilege roles such as owner, editor, or various administrative roles (e.g., storage.admin, compute.admin).
This rule detects potential credential abuse by monitoring for a burst of GCP access or ID token generation requests by a single user across five or more distinct resource targets within a single project. Such behavior is often indicative of an adversary enumerating resources or performing reconnaissance to identify reachable services or systems after successfully assuming a principal's identity.
Detects the creation or update of IAM custom roles in Google Cloud Platform. This activity can be indicative of privilege escalation or the establishment of persistence by an adversary modifying access controls.
This rule monitors for suspicious activity often associated with credential or sensitive information discovery in development environments. It identifies: 1) Access to configuration files or directories related to AI-powered development tools (e.g., Cursor, Windsurf, Zed) which may store environment variables or API keys; 2) Network connections to common cloud instance metadata endpoints; and 3) Execution of command-line tools attempting to access AWS secrets or configuration management APIs (Secrets Manager, SSM).
This rule monitors for processes making requests to cloud instance metadata services (GCP) or accessing sensitive secrets and parameters via AWS CloudTrail. Such activity may indicate an attacker attempting to enumerate instance identities, retrieve temporary security credentials, or access managed configuration secrets.
Detects potentially unauthorized data exfiltration or bulk extraction activities within Google Cloud BigQuery. The rule monitors for large-scale data queries (SELECT * or queries without filters), data exports to external Google Cloud Storage buckets, and queries executed by automated scripts or tools, which are common indicators of staged data theft following cloud environment compromise.
Detects modifications to Google Cloud IAM policies where permissions are granted that allow service account impersonation or key management (e.g., serviceAccountTokenCreator, serviceAccountKeyAdmin, workloadIdentityUser, serviceAccountUser). These roles are frequently abused by attackers to gain durable, persistent access or escalate privileges by generating tokens as highly-privileged service accounts without requiring an existing service account key.
Detects the usage of the Google Cloud IAM Credentials API to generate OAuth access tokens, OIDC ID tokens, sign JWTs, or sign blobs as a service account. This behavior indicates an identity assuming a service account's permissions, a common technique for privilege escalation or lateral movement in GCP environments.
Detects authorization, token grants, or consent events for two specific Google Workspace application ClientIDs, which may be indicative of OAuth application consent abuse or malicious integration.
Detects the creation of Google Cloud Dataflow jobs that exhibit indicators of malicious data exfiltration pipelines, such as usage of suspicious job names (common with exfiltration tools), service account delegation, or execution via scripted user agents.
GCP Service Account or Key Creation
Cortex XDR
Detects the creation of Google Cloud Platform (GCP) service accounts or service account keys. Service account keys provide long-lived, programmatic access to cloud resources that persist beyond password resets or MFA requirements, making them a common target for attackers looking to maintain persistence, conduct lateral movement, or escalate privileges within a GCP environment.
Detects Server-Side Request Forgery (SSRF) attempts against a GCP Cloud Run service. The rule identifies malicious payloads targeting the 'url' parameter, which utilize path traversal sequences (e.g., ../, %2f, %5c) to escape the GitHub repository segment or attempt to access sensitive local system files like /proc/self/environ, /app/main.py, or /app/requirements.txt.
Detects Server-Side Request Forgery (SSRF) attempts using a double-slash URL manipulation technique. Adversaries append an absolute local file path (e.g., /etc/passwd or /proc/self/environ) after a GitHub blob URL to bypass URL validation logic commonly found in web proxies, API gateways, and serverless environments like GCP Cloud Run.
This rule identifies web requests containing path traversal sequences (such as '..', '..%2f', or null bytes) or attempts to access sensitive system files (e.g., 'etc/passwd', 'proc/self/environ') within URL query parameters. The rule normalizes different URL query fields and applies regex matching to detect common encoding bypass techniques used to exploit web applications.
This rule detects potential exfiltration attempts from a GCP Cloud Run container by monitoring for outbound network connections triggered by processes reading sensitive local files. The files being monitored include environment variable configurations (/proc/self/environ) and application source code, which may contain credentials or service account tokens.
Detects incoming web requests to GCP Cloud Run services that exhibit patterns associated with Server-Side Request Forgery (SSRF) exploitation. The rule monitors for URLs containing GitHub blob paths combined with path traversal sequences ('//') that point to sensitive internal system paths such as /proc/, /etc/, or /var/task/.
This rule detects potentially malicious HTTP requests targeted at Google Cloud Run services that attempt to access restricted or internal application paths, such as '/app/' or '/var/task/'. These patterns often indicate attempts to probe for or exploit vulnerable web application files, internal scripts, or configuration files (e.g., 'graph_api.py', 'graph.zip') commonly found in serverless environments.
This rule detects potential developer workstation compromise by monitoring for suspicious child process creation (shells/interpreters) from common development tools (Code.exe, node.exe, python.exe) followed by subsequent authentication to cloud environments (Azure, AWS, or GCP) within a 60-minute window. This behavior is indicative of a developer's machine being compromised to harvest session tokens or credentials to access cloud resources.
Detects Server-Side Request Forgery (SSRF) attempts exploiting URL parser differentials. Attackers append a double-slash sequence to a legitimate github.com blob URL to trick the backend into resolving an absolute local filesystem path. The rule specifically targets sensitive paths such as /proc/self/environ, /var/task/, and application source files to perform Local File Read (LFR) or access internal cloud metadata services.
This rule detects outbound network traffic from an instance or container to the Google Cloud metadata service (metadata.google.internal or 169.254.169.254). Such activity is highly indicative of Server-Side Request Forgery (SSRF) exploitation, where an attacker attempts to retrieve service account credentials or instance metadata from an internal service.
Page 11 of 22