Browse Rules

ZIA Cloud Account Created

This rule detects when new cloud account was created.

Pathlock TDnR - SAP Cloud Account Administration Events

Detects account administration events in SAP Cloud environments, forwarded by Pathlock Threat Detection and Response. Suspicious cloud account activities may indicate unauthorized provisioning, privilege escalation, or account takeover in SAP cloud tenants.

Google Cloud Service Account Modified

Identifies when a service account is modified in Google Cloud.

[CISCO-SCA] Azure Transfer Data To Cloud Account

[CISCO-SCA] Azure Transfer Data To Cloud Account

Google Cloud Service Account Disabled or Deleted

Identifies when a service account is disabled or deleted in Google Cloud.

Google Cloud Service Account Key Created or Uploaded

Detects when a service account key is created in or uploaded to a monitored Google Cloud project.

AWS Account Discovery [snowflake-awscloudtrail]

Adversaries may attempt to get a listing of cloud accounts. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. -- Threat Actor Association: GUI-vil

AWS Account Discovery [splunk-awscloudtrail]

Adversaries may attempt to get a listing of cloud accounts. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. -- Threat Actor Association: GUI-vil

GCP Service Account Deletion

Identifies when a service account is deleted in Google Cloud Platform (GCP). A service account is a special type of account used by an application or a virtual machine (VM) instance, not a person. Applications use service accounts to make authorized API calls, authorized as either the service account itself, or as G Suite or Cloud Identity users through domain-wide delegation. An adversary may delete a service account in order to disrupt their target's business operations.

Disabled Account Attack Disruption

Attack disruption disabled a cloud/hybrid account due to suspicious activities. The query lists the accounts that have been disabled by MDI.

Snowflake External Data Share

Detect when an external share has been initiated from one source cloud to another target cloud.

GCP Service Account Disabled

Identifies when a service account is disabled in Google Cloud Platform (GCP). A service account is a special type of account used by an application or a virtual machine (VM) instance, not a person. Applications use service accounts to make authorized API calls, authorized as either the service account itself, or as G Suite or Cloud Identity users through domain-wide delegation. An adversary may disable a service account in order to disrupt to disrupt their target's business operations.

GCP Inbound SSO Profile Created

GCP Service Account Creation

Identifies when a new service account is created in Google Cloud Platform (GCP). A service account is a special type of account used by an application or a virtual machine (VM) instance, not a person. Applications use service accounts to make authorized API calls, authorized as either the service account itself, or as G Suite or Cloud Identity users through domain-wide delegation. If service accounts are not tracked and managed properly, they can present a security risk. An adversary may create

GCP Workforce Pool Created or Updated

GCP CloudBuild Potential Privilege Escalation

Detects privilege escalation attacks designed to gain access to the Cloud Build Service Account. A user with permissions to start a new build with Cloud Build can gain access to the Cloud Build Service Account and abuse it for more access to the environment.

GCP Workload Identity Pool Created or Updated

GCP Service Account Key Creation

Identifies when a new key is created for a service account in Google Cloud Platform (GCP). A service account is a special type of account used by an application or a virtual machine (VM) instance, not a person. Applications use service accounts to make authorized API calls, authorized as either the service account itself, or as G Suite or Cloud Identity users through domain-wide delegation. If private keys are not tracked and managed properly, they can present a security risk. An adversary may c

Suspicious Snowflake Sessions - Unusual Application

Detects unusual (non-common) applications and client characteristics that have been used to connect to a Snowflake account

AWS RDS Snapshot Shared

An RDS snapshot was shared with another account. This could be an indicator of exfiltration.

Pathlock TDnR - SAP BTP Cloud Foundry Events

Detects security events from SAP BTP Cloud Foundry environments, forwarded by Pathlock Threat Detection and Response. Anomalous BTP Cloud Foundry activity may indicate unauthorized application deployments, service account abuse, or data exfiltration from cloud-native SAP workloads.

GCP IAM Service Account Key Deletion

Identifies the deletion of an Identity and Access Management (IAM) service account key in Google Cloud Platform (GCP). Each service account is associated with two sets of public/private RSA key pairs that are used to authenticate. If a key is deleted, the application will no longer be able to access Google Cloud resources using that key. A security best practice is to rotate your service account keys regularly.

GCP storage hmac keys create

There is a feature of Cloud Storage, “interoperability”, that provides a way for Cloud Storage to interact with storage offerings from other cloud providers, like AWS S3. As part of that, there are HMAC keys that can be created for both Service Accounts and regular users. We can escalate Cloud Storage permissions by creating an HMAC key for a higher-privileged Service Account.

AWS Snapshot Made Public

An AWS storage snapshot was made public.

Palo Alto Prisma Cloud - Multiple failed logins for user

'Detects multiple failed logins for the same user account.'