Christopher Scott
@ScochaNewcastle upon TyneCompletionist
0 followers20 downloads229 copies7 likes1,247 views
54 detections
Filters
Last updated
All Time
Detection languages
33
20
1
Categories
22
22
9
8
7
Platforms
27
17
7
2
2
Products / Services
21
10
7
5
4
MITRE Techniques
20
12
6
6
6
Detects potential password spraying activity characterized by a high number of distinct IP addresses failing authentication for a specific user, followed shortly by a successful authentication for that same user from a geographic location outside the United Kingdom.
This rule detects the use of the Windows native utility 'wbadmin.exe' to delete the backup catalog. This behavior is commonly associated with ransomware or other malicious activity aimed at inhibiting system recovery by removing the ability to restore data from built-in Windows backup utilities.
This rule detects modifications to administrative privileges in Google Workspace, including granting or revoking administrative roles and delegating administrative responsibilities. Such activities are critical security events that could indicate unauthorized privilege escalation, account compromise, or malicious administrative activity.
This rule monitors for administrative role updates recorded by PUSH Security. It detects when an actor grants or modifies privileged roles for a target account, which is a common indicator of potential account manipulation, privilege escalation, or persistence establishment within a managed environment.
This rule detects modifications to Google Workspace user account recovery methods, including the generation or deletion of 2SV (2-Step Verification) backup scratch codes, and changes to recovery email addresses or recovery phone numbers. These actions are often performed during account takeover attempts to establish persistence or facilitate bypassing MFA.
This rule detects potentially malicious activity against accounts classified as having a high blast radius. It correlates three stages of behavior: observed failed authentication attempts (brute force) against a high-blast-radius account, a password reset for that same account, and a subsequent successful logon outside of standard business hours (using Logon Types 3 or 10). The rule uses a password reset event as the mandatory anchor and flags suspicious sequences of events leading up to or following this change.
This rule detects the generation of 2-Step Verification (2SV) backup/scratch codes in Google Workspace. Backup codes allow a user to bypass standard MFA, making their generation a significant security event that may indicate an attacker is attempting to maintain persistent access to an account, often following a compromise or as a preparation for further malicious activity.
This rule monitors GCP VPC Flow logs for potential command and control (C2) or data exfiltration activity by identifying internal-to-external network connections that exhibit high novelty. It calculates the percentage of new destination IP addresses contacted by internal source IPs within a single day. Alerts are triggered when a source IP initiates connections to at least 20 unique external destinations, where at least 20% of those destinations have never been contacted by that source in the previous day. This behavioral analysis is designed to detect reconnaissance, scanning, or large-scale data exfiltration patterns.
This rule monitors GCP Audit logs for the creation or deletion of VPN tunnels. It classifies the actor (human vs. service account) and validates the source of the action against expected patterns such as the use of Terraform and authorized network sources. It highlights activity that deviates from standard infrastructure-as-code deployments or originates from unusual network sources, aiding in the detection of unauthorized or suspicious network configuration changes.
This rule monitors Google Cloud Platform (GCP) Audit Logs for changes to VPC network routes, specifically tracking 'insert' and 'delete' operations. It classifies actors as either human or service account, flags non-Terraform service account modifications, and identifies service accounts originating from unexpected network sources to detect potentially unauthorized infrastructure changes.
Page 2 of 6