Google SecOps
@GoogleSecOps4 followers1,217 downloads359 copies1 like18,019 views
727 detections
Filters
Last updated
All Time
Detection languages
725
2
Categories
187
173
109
81
75
Platforms
245
187
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
223
173
97
92
75
CVEs
4
4
This rule detects successful login activity by administrative users to Microsoft Office 365 applications that are not part of a predefined list of common, first-party Microsoft cloud applications. This helps identify potentially unauthorized or unusual access to less common applications within the O365 ecosystem by privileged accounts. The rule specifically targets 'USER_LOGIN' events from 'Office 365' where the login is allowed and the application ID is not in the 'first_party_ms_cloud_apps' list. It also filters for users present in an 'msazure_admin_watchlist'.
This rule detects persistent login activity to the Azure AD PowerShell application. Specifically, it looks for successful user logins to the application identified by the product object ID '1b730954-1685-4b74-9bfd-dac224a7b894' (which corresponds to Azure AD PowerShell) by the same user ID over a 24-hour period. The rule is designed to flag continuous access to this administrative tool, which is not considered a security best practice and warrants further investigation.
This rule detects the creation or modification of anonymous links in OneDrive. Anonymous links can be used to export files from OneDrive, posing a risk of data leakage, especially in organizations that do not support their creation.
This rule detects when a user is added to a role in Microsoft Entra ID (formerly Azure AD) outside of a Privileged Identity Management (PIM) process. While adding users to roles is a normal administrative action, performing it outside of PIM can indicate a potential security risk, as PIM provides just-in-time access and approval workflows for privileged roles. This rule specifically looks for "Add member to role outside of PIM (permanent)" events, which are often triggered via PowerShell API calls.
This rule detects successful login activities to the Azure AD PowerShell application within Office 365. While legitimate administrative tasks often involve using Azure AD PowerShell, adversaries can also abuse this access to gather user information or perform other malicious actions. The rule specifically looks for successful user logins to the application identified by the product object ID '1b730954-1685-4b74-9bfd-dac224a7b894'. It also includes commented-out filters for ADFS Sync Accounts, which are typically legitimate and run every 30 minutes.
This rule detects when a client secret is added to an application within Azure AD. While this action can be legitimate for application configuration and integration, it can also be abused by adversaries to establish persistence within the environment. By adding a secret, an attacker can maintain access to the application and potentially associated resources, even if their initial access method is remediated. The rule specifically looks for 'Update application' events related to 'Certificates and secrets management' in Azure AD Directory Audit logs.
This rule detects when files are downloaded from OneDrive using anonymous links. While not inherently malicious, some organizations prohibit anonymous links due to data leakage risks. The rule specifically looks for 'FileDownloaded' events from Office 365 where the principal user ID indicates an anonymous access (e.g., 'urn:spo:anon#' or 'anonymous').
This rule detects successful Office 365 login activity to applications that are not part of a predefined list of common, first-party Microsoft Cloud applications. This can help identify potentially unauthorized or unusual access to cloud resources via less common applications, which might indicate credential compromise or an attempt to bypass standard access controls. The rule specifically excludes certain known benign Microsoft application IDs and allows for filtering out ADFS synchronization traffic.
This rule detects a sequence of events where a new user account is created in Entra ID (formerly Azure AD) and then, shortly after, that same user is assigned an administrative-level role. This behavior can indicate an attacker establishing persistence or escalating privileges by creating a new account and immediately granting it high-level access.
Detects when a new user is created in Entra ID (formerly Azure Active Directory) and subsequently assigned administrative or other specified roles within a 90-minute window. This rule aims to identify potential privilege escalation or suspicious account setup activities.
Page 30 of 73