Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
74 detections
Filters
Last updated
All Time
Detection languages
29
12
10
10
7
Contributors
32
24
7
5
2
Categories
34
17
16
12
12
Platforms
52
12
11
7
7
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
19
17
16
14
14
CVEs
1
1
1
This rule detects the creation of Google Cloud Platform (GCP) persistent disk snapshots. Monitoring for disk snapshot creation is critical as adversaries may use this functionality to create backups of sensitive virtual machine disks for exfiltration, staging, or offline analysis, effectively bypassing traditional network-based egress controls.
This rule monitors GCP VPC Flow logs for unusual network traffic patterns originating from internal private IP address ranges (RFC 1918). It calculates daily distinct destination IP and port counts per source IP, establishing a baseline of normal behavior. It flags anomalies where current traffic ratios for destinations or ports exceed a threshold of 3x compared to the baseline, or identifies 'new host spray' patterns where a source suddenly targets an unusually high number of ports or destinations without prior history, indicating potential reconnaissance or scanning activity.
This rule detects unsuccessful attempts by human users to delete objects from Google Cloud Storage buckets that are protected by bucket-level retention policies. By filtering out service accounts, the rule specifically focuses on non-automated, human-initiated actions that violate data retention requirements.
Detects potentially unauthorized data exfiltration or bulk extraction activities within Google Cloud BigQuery. The rule monitors for large-scale data queries (SELECT * or queries without filters), data exports to external Google Cloud Storage buckets, and queries executed by automated scripts or tools, which are common indicators of staged data theft following cloud environment compromise.
Detects modifications to Google Cloud IAM policies where permissions are granted that allow service account impersonation or key management (e.g., serviceAccountTokenCreator, serviceAccountKeyAdmin, workloadIdentityUser, serviceAccountUser). These roles are frequently abused by attackers to gain durable, persistent access or escalate privileges by generating tokens as highly-privileged service accounts without requiring an existing service account key.
Detects the usage of the Google Cloud IAM Credentials API to generate OAuth access tokens, OIDC ID tokens, sign JWTs, or sign blobs as a service account. This behavior indicates an identity assuming a service account's permissions, a common technique for privilege escalation or lateral movement in GCP environments.
Detects the creation of Google Cloud Dataflow jobs that exhibit indicators of malicious data exfiltration pipelines, such as usage of suspicious job names (common with exfiltration tools), service account delegation, or execution via scripted user agents.
GCP Service Account or Key Creation
Cortex XDR
Detects the creation of Google Cloud Platform (GCP) service accounts or service account keys. Service account keys provide long-lived, programmatic access to cloud resources that persist beyond password resets or MFA requirements, making them a common target for attackers looking to maintain persistence, conduct lateral movement, or escalate privileges within a GCP environment.
Detects Server-Side Request Forgery (SSRF) attempts against a GCP Cloud Run service. The rule identifies malicious payloads targeting the 'url' parameter, which utilize path traversal sequences (e.g., ../, %2f, %5c) to escape the GitHub repository segment or attempt to access sensitive local system files like /proc/self/environ, /app/main.py, or /app/requirements.txt.
This rule detects potential exfiltration attempts from a GCP Cloud Run container by monitoring for outbound network connections triggered by processes reading sensitive local files. The files being monitored include environment variable configurations (/proc/self/environ) and application source code, which may contain credentials or service account tokens.
Detects incoming web requests to GCP Cloud Run services that exhibit patterns associated with Server-Side Request Forgery (SSRF) exploitation. The rule monitors for URLs containing GitHub blob paths combined with path traversal sequences ('//') that point to sensitive internal system paths such as /proc/, /etc/, or /var/task/.
This rule detects potentially malicious HTTP requests targeted at Google Cloud Run services that attempt to access restricted or internal application paths, such as '/app/' or '/var/task/'. These patterns often indicate attempts to probe for or exploit vulnerable web application files, internal scripts, or configuration files (e.g., 'graph_api.py', 'graph.zip') commonly found in serverless environments.
This rule detects outbound network traffic from an instance or container to the Google Cloud metadata service (metadata.google.internal or 169.254.169.254). Such activity is highly indicative of Server-Side Request Forgery (SSRF) exploitation, where an attacker attempts to retrieve service account credentials or instance metadata from an internal service.
Detects web requests containing patterns indicative of Server-Side Request Forgery (SSRF) attempts targeting the Google Cloud Platform (GCP) Instance Metadata API (metadata.google.internal). The rule monitors for attempts to access metadata endpoints, including token retrieval paths.
Detects Server-Side Request Forgery (SSRF) attempts targeting cloud provider metadata services (specifically GCP) or sensitive local files like '/proc/self/environ' using common bypass patterns and request structures. These requests typically originate from an application process attempting to access internal environment variables or cloud identity metadata.
This rule detects attempts to exfiltrate GCP service account credentials by performing a Server-Side Request Forgery (SSRF) attack targeting the GCP metadata server or local system files. It correlates suspicious outbound request patterns with subsequent response bodies containing standard GCP credential fields, excluding known legitimate authentication traffic to cloud APIs.
Detects suspicious interactions with Google Cloud Pub/Sub APIs occurring shortly after an OAuth2 token request, specifically when the activity is performed by processes other than standard Google Cloud SDK tools (gcloud, gsutil, etc.). This behavior may indicate an attempt to utilize stolen OAuth tokens to exfiltrate or manipulate data within a GCP environment.
Detects attempts by processes to access the Google Cloud Platform Instance Metadata Service (IMS) at 169.254.169.254 or via the 'metadata.google.internal' DNS entry. This is often an indicator of reconnaissance, SSRF exploitation, or credential theft attempts by an adversary on a compromised cloud instance.
This rule detects potentially malicious web requests attempting to access sensitive local system files, environment variables, or application source code within a cloud-hosted application environment. The detection logic focuses on URI patterns indicative of Local File Inclusion (LFI) attempts targeting proc filesystem nodes, credential configuration files, or application source bundles.
Detects Server-Side Request Forgery (SSRF) attempts against the Google Cloud metadata server (169.254.169.254 or metadata.google.internal) within GCP Cloud Run request logs. This rule identifies inbound requests attempting to access sensitive cloud metadata paths or tokens, often indicative of an adversary attempting to extract service account credentials or instance information.
Detects incoming HTTP requests that use URL-encoding (e.g., %2e%2e, %2f) to obfuscate path traversal sequences targeting sensitive operating system or container application files, such as /proc/self/environ or /etc/passwd. This technique is often used to bypass security filters or URL validation mechanisms in web applications.
Page 2 of 4