Google SecOps
@GoogleSecOps4 followers1,217 downloads379 copies1 like18,177 views
758 detections
Filters
Last updated
All Time
Detection languages
756
2
Categories
189
188
109
81
77
Platforms
257
198
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
237
181
109
95
79
CVEs
4
4
This rule detects attempts to establish persistence by modifying Windows Registry Run keys to execute PowerShell commands or scripts. It specifically looks for modifications to common Run key paths (CurrentVersion\Run, Wow6432Node\Microsoft\Windows\CurrentVersion\Run, Policies\Explorer\Run) that contain keywords indicative of PowerShell execution, such as 'powershell', 'pwsh', 'frombase64string', download functions, hidden window styles, no profile, encoded commands, execution policy bypass, and various Invoke- commands (Invoke-Expression, Invoke-Command, Invoke-WebRequest).
This rule detects attempts to clear the ShimCache (Application Compatibility Cache) on a Windows system. Adversaries may clear this cache to remove forensic evidence of executed programs. The rule specifically looks for `rundll32` executing `apphelp.dll` with `ShimFlushCache` or `#250`, or `rundll32` executing `kernel32.dll` with `BaseFlushAppCompatCache` or `#46`.
ShimCache Flush
YARA-L
Detects actions that clear the local ShimCache and remove forensic evidence
Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
Detects potential malicious modification of the property value of UseLogonCredential from HKLM:\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\WDigest to enable clear-text credentials
Detects changes to the default RDP port. Remote desktop is a common feature in operating systems. It allows a user to log into a remote system using an interactive session with a graphical user interface. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).
Detect modification of the startup key to a path where a payload could be stored to be launched during startup
Detects tampering of RDP Terminal Service/Server sensitive settings. Such as allowing unauthorized users access to a system via the 'fAllowUnsolicited' or enabling RDP via 'fDenyTSConnections'...etc
Detects tampering of RDP Terminal Service/Server sensitive settings. Such as allowing unauthorized users access to a system via the 'fAllowUnsolicited' or enabling RDP via 'fDenyTSConnections', etc.
Reg Add Suspicious Paths
YARA-L
Detects when an adversary uses the reg.exe utility to add or modify new keys or subkeys
Page 10 of 76