4/24 KPMG + Permiso LUCR-3 (Scattered Spider) Threat Briefing

REGISTER NOW

Our Integrations

Covering More of the Cloud's Attack Surface

Modern threat actors are compromising identity providers, and moving across environments through cloud service providers, SaaS apps, and CI/CD pipelines. Permiso's library of integrations tracks activity across cloud environments. 

illustration-bomb-cloud
illustration-laser-hero
bricks-2
illustration-cloud-bottom-2
bricks-1

Integration List

ec2-detection

Amazon

EC2

Detect suspicious SSH activity, EC2 snapshot stealing or public access, human created large or multi region instances and more.

aws-s3-detections

Amazon

S3

Detect bucket versioning being disabled, MFADelete disabled, Workmail Mailbox Exported Public, Public access and more.

aws-iam-detections-1

Amazon

IAM

Monitor Root passwords or email changes, activity of potentially compromised secrets, mass mailer scripts, roles that allow for external access and more.

aws-config-detections-1

Amazon

Config

Monitor if Amazon Config has been disabled in any of your environments, a common tactic by threat actors.

aws-ECS-detections

Amazon

ECS

Detects when an Elastic Container Service (ECS) Task Definition has been modified and run.

aws-Cloudwatch-detections

Amazon

CloudWatch

Detect when a CloudWatch alarm has been deleted, this may be an attempt to evade detection.

aws-api-gateway-detections

Amazon

ApiGateway

Detect when an AWS API Gateway key was created. These keys grant access to an API, often for development purposes.

amazon-workmail

Amazon

Workmail

Detect when a workmail mailbox has been exported, exported public or if a suspicious user has been created.

amazon-ssm-detections

Amazon

SSM

Detect SSM remote code execution and suspected malicious script execution.

amazon-guardduty-detections

Amazon

GuardDuty

Monitor when IPSet Lists have changed, threat lists of changed or status has been altered.

amazon-rds-detections

Amazon

RDS

Monitor RDS Snapshot sharing with vendors, given or restored public access, as well as deletion protection disabled and master password resets.

amazon-cloudtrail-detections

Amazon

CloudTrail

Get notified when CloudTrail logging has been stopped or deleted, a common tactic employed by threat actors.

amazon-route53-detections

Amazon

Route53

Monitor Route53 domain transfer activity as well as those created with public zone selected.

amazon-codebuild-detections

Amazon

CodeBuild

Detect any AWS CodeBuild projects that have been made public.

amazon-resources-access-manager-detections

Amazon

Resource Access Manager (RAM)

Learn when AWS Resource Access Manager (RAM) settings were modified

amazon-ses-detections

Amazon

SES

SES Access key activity such as enable sending, request production status, list identities verified, verify sending status, key abuse, key list identities and more.

amazon-ebs-detections

Amazon

Elastic Block Storage (EBS)

Monitor when Amazon Elastic Block Store (EBS) encryption has been disabled for a particular region.

amazon-sts-detections

Amazon

STS

Learn when federation tokens are created that have overly permissive policies that allows all actions.

aws-secrets-manager-detections-3

Amazon

Secrets Manager

Detect when an identity has successfully retrieved a key from AWS Secrets Manager via the GetSecretValue action.

microsoft-azure-compute-detections

Microsoft

Azure Compute

Learn when an azure virtual machine (VM) has had commands executed against it, which may execute as System.

storage-blob

Microsoft

Azure Blob Storage

Detect when Azure blob storage has had permissions modified that could lead to data exposure.

azure-key-vault

Microsoft

Azure Key Vault

Monitor when an Azure Key Vault was either created or updated in order to secure certificates, connection strings, encryption keys and passwords.

microsoft-azure-automation-detections

Microsoft

Azure Automation

Discover when Automation Runbooks have been created or deleted, webhooks have been created or code has changed, as well as when accounts were created or deleted.

microsoft-defender

Microsoft

Defender

Know when an Azure Defender for Cloud alert has been suppressed, a common tactic by threat actors.

azure-network-detections

Microsoft

Azure Network

Monitor when Azure Network watchers are created, updated or deleted, packet capture was created or updated or network taps are created or updated.

azure-backup-vault-detections

Microsoft

Azure Backup Vault

Learn when Azure Backup Vaults are created or disabled, signs of ransomware or similar attacks.

azure-rbac-detections-1

Microsoft

Azure Role-Based Access Control

Learn when Azure Backup Vaults are created or disabled, signs of ransomware or similar attacks.

microsoft-entra-id-detections

Microsoft

Entra ID

Learn when service principle creates certificates or secrets, PIM identity denied role as well as when alerts are fired or disabled, as well as tenants or resources offboarded. Monitor when general admin or high risk admin, privileged admin, medium risk admin and global admin role memberships are added.

microsoft-entra-id-detections

Microsoft

Entra ID IAM

Learn when password reset verification is blocked, registered app certificates created as well as suspicious MFA activity such as factor deletion or rotation by both user and Admins.

okta-detections

Okta

Monitor when multiple MFA verifications were denied, factors were reset or deactivated, as well as Okta detections such as threat suspected, suspicious sessions, high risk session API tokens created and more.

google workspace logo

Google Workspace

Applications

Detect suspicious gmail activity such as deep scan disabled, routing rules modified or delayed delivery disabled, in addition to password reuse enabled or strong enforcement disabled.

google workspace logo

Google Workspace

IAM

Monitor when accounts are disabled, passwords have leaked, MFA disabled, admin role assignment and suspicious login behavior.

google workspace logo

Google Workspace

Account

Learn when domains have been added or removed to the trusted list for the account.

google workspace logo

Google Workspace

Drive

Detect when an identity has performed a mass deletion or download of files and folders.

microsoft-exchange-detections-1

Microsoft

Exchange

Detect transport rules and inbox rules that redirect or forward to external domains, when identities give full access to another mailbox or forwarded to an external domain.

microsoft-sharepoint-detections

Microsoft

Sharepoint

Detect when an identity has performed a mass deletion or download of files and folders, as well as malware detections via Microsoft 365 virus detection.

microsoft-onedrive-detections

Microsoft

OneDrive

Detect when an identity has performed a mass deletion or download of files and folders, as well as malware detections via Microsoft 365 virus detection.

github-detections-1

Github

Monitor when Github repositories have been transferred outside the organization or updated to public.

jira-detections

JIRA

Monitor when a Jira Service has been deleted, mail queue flushed, monitor JMX disabled, global permissions added and more.

one-password

1Password

Threat detection for 1Password's password management system.

atlassian logo

Confluence

Detection for your company's wiki when support Zip is created or downloaded, data is exported, or global settings are edited.

Easter egg donut
Bricks
Easter egg cupcake
Easter egg lollipop
illustration-easter-egg-icecream
cloud
bricks

Our founders hate the spotlight

Our founders hate the spotlight