Google SecOps
@GoogleSecOps4 followers1,217 downloads359 copies1 like18,019 views
727 detections
Filters
Last updated
All Time
Detection languages
725
2
Categories
187
173
109
81
75
Platforms
245
187
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
223
173
97
92
75
CVEs
4
4
Continual logins to Azure AD PowerShell app are not a security best practice, if this is observed, additional investigation is needed
Detects when an Entra ID conditional access policy has been modified
Secrets added to applications have legitimate purposes, but can also be a method of persistence.
This rule detects O365 login activity to apps other than a defined list of first party MS Cloud Apps. Note that Azure Active Directory PowerShell and custom Azure apps are not in this list by default
Detects file downloads using O365 or Graph Activity logs, not including anonymous file links
Detect when the Unified Audit Log is enabled
Adding users to roles is expected but if it occurs outside of PIM, validation should occur
Detects Azure AD admin login activity to apps other than a defined list of first party MS Cloud Apps. Note that Azure Active Directory PowerShell and custom Azure apps are not in this list by default
This rule detects Azure AD login activity to apps other than a defined list of first party MS Cloud Apps. Note that Azure Active Directory PowerShell and custom Azure apps are not in this list by default
Secrets added to applications have legitimate purposes, but can also be a method of persistence. This alert will trigger on creation, modification or delete of a client secret
Page 32 of 73