Christopher Scott
@ScochaNewcastle upon TyneCompletionist
0 followers20 downloads229 copies7 likes1,247 views
54 detections
Filters
Last updated
All Time
Detection languages
33
20
1
Categories
22
22
9
8
7
Platforms
27
17
7
2
2
Products / Services
21
10
7
5
4
MITRE Techniques
20
12
6
6
6
This rule detects the deletion of Google Cloud Platform (GCP) network firewall rules. It monitors GCP audit logs for 'v1.compute.firewalls.delete' or 'beta.compute.firewalls.delete' actions. The rule categorizes the actor (human vs. service account) and identifies if the deletion originated from Terraform, providing context on whether the action was likely an automated infrastructure-as-code change or manual intervention.
This rule detects the creation of email monitors or mail routing destinations within Google Workspace. These actions are indicative of persistent access methods where an attacker redirects or copies sensitive emails to an external or attacker-controlled account, enabling long-term intelligence gathering.
This rule monitors GCP audit logs for the modification, creation, or deletion of organization policies. These actions are often associated with an attacker attempting to weaken the security posture of the cloud environment by modifying or disabling restrictive security configurations.
A Compute Engine instance created outside the expected europe-west1/europe-west2 regions.
This rule detects changes to VPC Network Peering configurations in Google Cloud Platform (GCP). VPC peering allows internal IP address connectivity across different VPC networks. Unauthorized modifications, such as adding or updating peering connections, could indicate an adversary attempting to establish lateral movement paths between network environments, facilitate data exfiltration, or modify network architecture to bypass security perimeters.
This rule detects instances where a user enters a protected password into an application that has not been configured or registered for SSO (Single Sign-On). It achieves this by identifying 'Protected password entered' events and using a join-anti operation to filter out sessions where an 'SSO_PASSWORD_USED' event was previously recorded for the same user and domain.
This rule detects high-volume outbound network traffic from a Google Cloud Platform (GCP) source IP to external (non-private/non-internal) destinations. It establishes a baseline of daily outbound traffic per source IP over time and triggers an alert if the current daily outbound volume exceeds 500MB and shows a significant increase (more than 3x the established average) compared to previous days. This behavior is often indicative of unauthorized data exfiltration or abnormal network activity.
Five or more service account keys created by the same principal, indicating mass credential generation.
This rule detects the creation of Google Cloud Platform (GCP) persistent disk snapshots. Monitoring for disk snapshot creation is critical as adversaries may use this functionality to create backups of sensitive virtual machine disks for exfiltration, staging, or offline analysis, effectively bypassing traditional network-based egress controls.
An IAM service account deleted or disabled, excluding the known Terraform automation account.
Page 3 of 6