Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
461 detections
Filters
Last updated
All Time
Detection languages
134
111
68
41
32
Contributors
136
63
56
49
29
Categories
264
153
62
60
59
Platforms
39,936
7,266
6,535
3,866
3,647
461
Products / Services
260
63
57
52
51
MITRE Techniques
148
103
61
58
58
CVEs
3
2
2
1
1
IDS Classtypes
7
5
5
4
3
IDS Protocols
27
Detects the use of common command-line tools (curl, wget, python, etc.) to interact with known cloud provider metadata service IP addresses or URL paths, often performed by shell processes. This behavior is frequently associated with initial reconnaissance or attempts to steal identity tokens from cloud-based virtual machines.
Detects outbound web requests to the Telegram API triggered by Google Apps Script components (sidebar macros). This pattern is indicative of malicious Google Docs or Slides files using embedded scripts to exfiltrate data or perform command-and-control communication via the Telegram API when the document is opened by a user.
Detects high-risk IAM policy modifications, specifically the attachment or creation of policies that grant wildcard permissions or full administrator access. The rule optionally correlates these permission changes with the recent creation of access keys or service account credentials for the same principal, indicating potential preparation for persistence or unauthorized access escalation.
Detects the use of common command-line tools (curl, wget, python, etc.) to interact with known cloud provider metadata service IP addresses or URL paths, often performed by shell processes. This behavior is frequently associated with initial reconnaissance or attempts to steal identity tokens from cloud-based virtual machines.
Detects unauthorized or suspicious use of Google Cloud Config Connector (KCC) service accounts to apply high-privilege IAM roles ('roles/owner' or 'roles/resourcemanager.organizationAdmin') at the Organization or Folder scope. This rule monitors for 'SetIamPolicy' API calls where the principal is identified as a KCC-related service account, flagging potential exploitation of KCC's authority to grant excessive permissions.
This rule detects unauthorized attempts by non-automation Kubernetes users to create or update IAM policies for Google Cloud resources via Config Connector (KCC). It specifically monitors for actions that assign high-privilege roles (e.g., Organization Owner, Organization Admin) to Organization-scoped resources, excluding authorized platform service accounts and KCC reconciliation traffic.
This rule detects unauthorized attempts by non-automation Kubernetes users to create or update IAM policies for Google Cloud resources via Config Connector (KCC). It specifically monitors for actions that assign high-privilege roles (e.g., Organization Owner, Organization Admin) to Organization-scoped resources, excluding authorized platform service accounts and KCC reconciliation traffic.
This rule detects unauthorized attempts by non-automation Kubernetes users to create or update IAM policies for Google Cloud resources via Config Connector (KCC). It specifically monitors for actions that assign high-privilege roles (e.g., Organization Owner, Organization Admin) to Organization-scoped resources, excluding authorized platform service accounts and KCC reconciliation traffic.
This rule detects unauthorized attempts by non-automation Kubernetes users to create or update IAM policies for Google Cloud resources via Config Connector (KCC). It specifically monitors for actions that assign high-privilege roles (e.g., Organization Owner, Organization Admin) to Organization-scoped resources, excluding authorized platform service accounts and KCC reconciliation traffic.
This rule detects unauthorized attempts by non-automation Kubernetes users to create or update IAM policies for Google Cloud resources via Config Connector (KCC). It specifically monitors for actions that assign high-privilege roles (e.g., Organization Owner, Organization Admin) to Organization-scoped resources, excluding authorized platform service accounts and KCC reconciliation traffic.
Detects Kubernetes RBAC Role or ClusterRole creation or update events that grant the 'create' verb on Config Connector (KCC) IAM custom resources (iampolicymembers, iampolicies, iampartialpolicies) by non-approved user identities. This could indicate an attempt to gain unauthorized control over cloud IAM policies through the Kubernetes API.
Detects Kubernetes RBAC Role or ClusterRole creation or update events that grant the 'create' verb on Config Connector (KCC) IAM custom resources (iampolicymembers, iampolicies, iampartialpolicies) by non-approved user identities. This could indicate an attempt to gain unauthorized control over cloud IAM policies through the Kubernetes API.
Detects Kubernetes RBAC Role or ClusterRole creation or update events that grant the 'create' verb on Config Connector (KCC) IAM custom resources (iampolicymembers, iampolicies, iampartialpolicies) by non-approved user identities. This could indicate an attempt to gain unauthorized control over cloud IAM policies through the Kubernetes API.
Detects Kubernetes RBAC Role or ClusterRole creation or update events that grant the 'create' verb on Config Connector (KCC) IAM custom resources (iampolicymembers, iampolicies, iampartialpolicies) by non-approved user identities. This could indicate an attempt to gain unauthorized control over cloud IAM policies through the Kubernetes API.
Detects Kubernetes RBAC Role or ClusterRole creation or update events that grant the 'create' verb on Config Connector (KCC) IAM custom resources (iampolicymembers, iampolicies, iampartialpolicies) by non-approved user identities. This could indicate an attempt to gain unauthorized control over cloud IAM policies through the Kubernetes API.
Detects when a Google Cloud Config Connector (KCC) Workload Identity-bound service account is granted overly permissive organization-level roles (roles/owner or roles/resourcemanager.organizationAdmin). This configuration deviates from the security best practice of using namespaced mode with per-namespace scoped identities, potentially allowing the KCC controller to gain broader access than required, which is a known attack vector for privilege escalation.
Detects when a Google Cloud Config Connector (KCC) Workload Identity-bound service account is granted overly permissive organization-level roles (roles/owner or roles/resourcemanager.organizationAdmin). This configuration deviates from the security best practice of using namespaced mode with per-namespace scoped identities, potentially allowing the KCC controller to gain broader access than required, which is a known attack vector for privilege escalation.
Detects when a Google Cloud Config Connector (KCC) Workload Identity-bound service account is granted overly permissive organization-level roles (roles/owner or roles/resourcemanager.organizationAdmin). This configuration deviates from the security best practice of using namespaced mode with per-namespace scoped identities, potentially allowing the KCC controller to gain broader access than required, which is a known attack vector for privilege escalation.
Detects when a Google Cloud Config Connector (KCC) Workload Identity-bound service account is granted overly permissive organization-level roles (roles/owner or roles/resourcemanager.organizationAdmin). This configuration deviates from the security best practice of using namespaced mode with per-namespace scoped identities, potentially allowing the KCC controller to gain broader access than required, which is a known attack vector for privilege escalation.
Detects a potential privilege escalation attempt where a namespace-scoped user creates a Config Connector (KCC) IAMPolicyMember resource, which is immediately followed by a high-privilege organization or folder-level SetIamPolicy operation executed by the KCC system service account, suggesting the KCC controller was manipulated to perform actions beyond the namespace's intended authorization.
Detects a potential privilege escalation attempt where a namespace-scoped user creates a Config Connector (KCC) IAMPolicyMember resource, which is immediately followed by a high-privilege organization or folder-level SetIamPolicy operation executed by the KCC system service account, suggesting the KCC controller was manipulated to perform actions beyond the namespace's intended authorization.
Page 6 of 22