Sunturai
Back to results
MediumMicrosoft Sentinel analytics

Cross-Cloud Suspicious user activity observed in GCP Envourment

This detection query aims to correlate potentially suspicious user activities logged in Google Cloud Platform (GCP) Audit Logs with security alerts originating from Microsoft Security products. This correlation…

Description

This detection query aims to correlate potentially suspicious user activities logged in Google Cloud Platform (GCP) Audit Logs with security alerts originating from Microsoft Security products. This correlation facilitates the identification of potential cross-cloud security incidents. By summarizing these findings, the query provides valuable insights into cross-cloud identity threats and their associated details, enabling organizations to respond promptly and mitigate potential risks effectively.

Detection logic

Detection requirements

Platform
ContainersESXiIaaSIdentity ProviderLinuxmacOSNetwork DevicesOffice SuiteSaaSWindows

The rule states no platform. This is derived from the 8 ATT&CK techniques it maps to.

Log source product
azureactivedirectoryidentityprotectiongcpauditlogsdefinitionmicrosoftcloudappsecuritymicrosoftdefenderadvancedthreatprotectionmicrosoftthreatprotection
Log source service
gcpauditlogssecurityalertsecurityalert_ipcsecurityalert_mdatp

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice