Google SecOps
@GoogleSecOps4 followers1,217 downloads359 copies1 like18,019 views
727 detections
Filters
Last updated
All Time
Detection languages
725
2
Categories
187
173
109
81
75
Platforms
245
187
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
223
173
97
92
75
CVEs
4
4
This rule detects login activity by Azure AD administrators to Microsoft cloud applications that are not part of a predefined list of common first-party applications. The rule specifically looks for successful logins where the application ID is not in the 'first_party_ms_cloud_apps' list and the user ID is present in the 'entra_id_admin_watchlist'. This helps identify potentially unusual or unauthorized access by administrators to less common or custom applications, which could indicate compromise or policy violation.
This detection rule identifies uncommon or suspicious Remote Monitoring and Management (RMM) tools, leveraging intelligence from the LOL-RMM (Living Off the Land RMM) project. While RMM tools are widely used for IT administration, remote support, and network management, they are also frequently abused by attackers, initial access brokers (IABs), and ransomware operators to establish persistent remote access, execute malicious commands, or deploy additional payloads. This rule detects RMM software that is not commonly observed in the environment, indicating potential unauthorized access or lateral movement.
Detects the execution of known attacker tools, including but not limited to those in the IronSharpPack toolset. These tools are commonly used for offensive security operations and may indicate malicious activity if observed in unauthorized environments.
This detection rule identifies the creation of a Windows service with a suspicious or known malicious name, as logged by Windows Event ID 7045 (`A service was installed in the system`). Threat actors, including those associated with ransomware and other advanced persistent threats (APTs), often create services to achieve persistence, lateral movement, remote execution, or privilege escalation. Detection of such activity is critical for identifying early-stage post-compromise behavior.
This rule identifies attempts to use expired or revoked OAuth refresh tokens to sign in to Entra ID (formerly Azure AD). This could indicate an adversary attempting to use a previously compromised token that is no longer valid, or a legitimate user whose token has expired due to inactivity (90 days) or revocation. The rule specifically looks for login events from 'Azure Activity' with a 'BLOCK' action and an action detail code of '50173', which corresponds to an expired or invalid refresh token.
This rule detects file downloads from Office 365 or Microsoft Graph Activity logs, specifically excluding anonymous file links. It looks for 'FileDownloaded' events from Office 365 and HTTP GET requests with a 302 response code from Microsoft Graph Activity, ensuring the download is not initiated by an anonymous user.
This rule detects Azure AD login activity to applications that are not part of a predefined list of first-party Microsoft Cloud Apps. This could indicate an attempt to access an unauthorized or unusual application within the Azure AD environment, potentially by a compromised account or an insider threat. The rule specifically excludes the 'On-Premises Directory Synchronization Service Account' to reduce false positives related to ADFS synchronization.
This rule detects when an Entra ID (formerly Azure Active Directory) conditional access policy has been modified. It specifically looks for 'USER_RESOURCE_UPDATE_CONTENT' events within Office 365, targeting the 'AzureActiveDirectory' application, where the 'extendedAuditEventCategory' is 'Policy' and the 'product_event_type' is 'Update policy.'. This indicates a change to a conditional access policy, which could be a legitimate administrative action or a malicious attempt to alter security controls.
This rule detects when a user is added to an administrative role within Microsoft Entra ID (formerly Azure AD). It specifically looks for events where the event type is 'USER_CHANGE_PERMISSIONS', the product event type is 'Add member to role', and the product name is 'Azure AD Directory Audit'. The rule is configured to trigger when a user is assigned to a role with the TemplateId '62e90394-69f5-4237-9190-012177145e10', which corresponds to the Global Administrator role in Azure AD. This activity is sensitive and warrants validation due to the high privileges associated with administrative roles.
This rule detects the creation, modification, or deletion of client secrets within an Entra ID (formerly Azure AD) application. While client secrets have legitimate uses, their manipulation can be a method for adversaries to establish persistence by gaining unauthorized access to an application's functionalities and data.
Page 29 of 73