Browse Rules

mitre_attack_T1548_002_windows_uac_bypass

Net use commands for SMB/Windows admin shares

GCP Privileged Operation

Detects privileged operations in GCP that could be part of a privilege escalation attempt, especially when following tag binding creation.

GCP Tag Binding Creation

Detects the creation of tag bindings in GCP, which could be part of a privilege escalation attempt using tag-based access control.

GCP IAM and Tag Enumeration

Detects enumeration of IAM policies and tags in GCP, which could be a precursor to privilege escalation attempts via tag-based access control.

GCP Privilege Escalation via TagBinding

Detects a sequence of events that could indicate a privilege escalation attempt via GCP's tag-based access control. The sequence includes: 1. Enumeration of IAM policies and tags 2. Creation of a tag binding 3. Performance of a privileged operation