Christopher Scott
@ScochaNewcastle upon TyneCompletionist
0 followers20 downloads229 copies7 likes1,247 views
54 detections
Filters
Last updated
All Time
Detection languages
33
20
1
Categories
22
22
9
8
7
Platforms
27
17
7
2
2
Products / Services
21
10
7
5
4
MITRE Techniques
20
12
6
6
6
This rule detects a potential password spraying attack followed by a successful sign-in from a non-UK location. It monitors for a threshold of failed sign-in attempts from distinct source IPs for a specific user within a 4-hour window, followed by a subsequent successful sign-in event from a different geographical location.
This rule detects modifications to Google Cloud Compute Engine instance metadata that involve sensitive keys, specifically those related to SSH key injection (ssh-keys, sshKeys, windows-keys) or automated execution via startup scripts (startup-script, startup-script-url). Attackers often modify these fields to achieve persistence or perform privilege escalation on compromised virtual machines.
This rule detects modifications to Google Cloud Platform (GCP) Cloud DNS managed zones, including creating, deleting, patching, updating, or changing records within a managed zone. It performs triage by categorizing the actor as either a human or a service account, checks for the use of Infrastructure-as-Code (Terraform), and flags potentially anomalous activity such as service accounts interacting with DNS outside of expected networks or without using automated tooling.
A Compute Engine image created from a disk, which can be used to copy VM disk data out of the environment
This rule monitors GCP VPC Flow logs for unusual network traffic patterns originating from internal private IP address ranges (RFC 1918). It calculates daily distinct destination IP and port counts per source IP, establishing a baseline of normal behavior. It flags anomalies where current traffic ratios for destinations or ports exceed a threshold of 3x compared to the baseline, or identifies 'new host spray' patterns where a source suddenly targets an unusually high number of ports or destinations without prior history, indicating potential reconnaissance or scanning activity.
Detects modifications to the service account assigned to a Google Compute Engine (GCE) instance. An adversary might alter the attached service account to escalate privileges, gain access to additional resources, or maintain persistence by leveraging an identity with higher permissions.
This rule detects modifications to Google Cloud Platform (GCP) Cloud Routers by monitoring audit logs for non-read operations. It flags changes made by human users, service accounts not utilizing Terraform, or service accounts originating from unexpected network sources as high-priority, while tracking general router creations and deletions.
This rule detects the deletion or disabling of Google Cloud IAM service accounts in GCP Audit Logs. These actions are often associated with cleanup activities by an adversary trying to remove persistence or hinder forensic investigations and incident response.
Detects access to Google Cloud Platform virtual machine serial port output. This API call (v1.compute.instances.getSerialPortOutput) allows users to view the console output of a VM instance, which may contain sensitive information, including boot logs, system diagnostic messages, or credentials that were inadvertently logged to the console by services or applications running on the instance.
Subnet lifecycle changes made by a human, a non-Terraform service account, or a service account operating from an unexpected network.
Page 4 of 6