User groups in Google Workspace are created to help manage users permissions and access to various resources and applications. The security label is only applied to a group when users within that group are expected to access sensitive data and/or resources so administrators add this label to easily manage security groups better. Adversaries with administrator access may modify a security group to allow external access from members outside the organization. This detection does not capture all modifications to security groups, but only those that could increase the risk associated with them.

Read More

This rule is triggered when indicators from the Threat Intel Filebeat module (v7.x) has a match against local file or network observations.

Read More

Identifies the creation or patching of potentially malicious role bindings. Users can use role bindings and cluster role bindings to assign roles to Kubernetes subjects (users, groups, or service accounts).

Read More

Identifies the export of an Amazon Relational Database Service (RDS) Aurora database snapshot.

Read More