Google SecOps
@GoogleSecOps4 followers1,217 downloads359 copies1 like18,019 views
727 detections
Filters
Last updated
All Time
Detection languages
725
2
Categories
187
173
109
81
75
Platforms
245
187
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
223
173
97
92
75
CVEs
4
4
This rule detects when the Unified Audit Log (UAL) is disabled in Office 365. This is identified by monitoring for the 'Set-AdminAuditLogConfig' product event type where the 'UnifiedAuditLogIngestionEnabled' field is set to 'False'. Disabling the UAL can indicate an adversary attempting to impair defenses and avoid detection by preventing their actions from being logged.
This rule detects when anonymous links are used to access files from OneDrive. While not always malicious, some organizations prohibit anonymous links due to data leakage risks. The rule specifically looks for 'USER_RESOURCE_ACCESS' events with 'FileAccessed' product event type from Office 365, where the principal user ID indicates an anonymous access (e.g., 'urn:spo:anon#' or 'anonymous').
This rule detects when anonymous links are used to access files from OneDrive. While this isn't always a sign of malicious activity, some organizations do not support the use of anonymous links because of the risk of data leakage. The rule specifically looks for 'USER_RESOURCE_ACCESS' events with 'AnonymousLinkUsed' as the product event type, originating from 'Office 365' and 'Microsoft', where the user ID is 'anonymous'.
This rule detects when the Unified Audit Log is enabled in Office 365. This event is triggered when the 'Set-AdminAuditLogConfig' cmdlet is used to set 'UnifiedAuditLogIngestionEnabled' to 'True'. While enabling logging is generally a positive security action, this rule is designed to alert if logging was previously disabled and is now being re-enabled, which could indicate an adversary attempting to cover their tracks after a period of operating without logging, or to restore logging after intentionally disabling it.
Identify Entra ID OAuth refresh tokens are attempted to be used but have expired. This could be because the token hasn't been used for 90 days or it has been revoked
Detects when a Key Management Service (KMS) decryption operation is carried out by a service account that is not in an allowlist. This behavior may indicate unauthorized access to sensitive information protected by KMS keys. The rule specifically looks for 'Decrypt' events within Google Cloud Platform (GCP) and flags any service account performing this action if it's not part of a predefined allowlist.
This rule detects when a Google Cloud identity experiences a low severity Security Command Center alert followed by a medium severity Security Command Center alert within a 24-hour period. This escalation in alert severity for the same identity could indicate an adversary attempting to gain further access or escalate privileges after an initial compromise or suspicious activity.
Adding users to administrative roles is needed but due to sensitivity of these roles, validation should occur when this occurs
Detect users who are newly created and then immediately assigned administrator level roles
Detect when the Unified Audit Log is disabled
Page 31 of 73