Google SecOps
@GoogleSecOps4 followers1,217 downloads379 copies1 like18,177 views
758 detections
Filters
Last updated
All Time
Detection languages
756
2
Categories
189
188
109
81
77
Platforms
257
198
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
237
181
109
95
79
CVEs
4
4
This rule detects attempts to dump credentials from the Local Security Authority Subsystem Service (LSASS) process using `WerFault.exe`. It specifically looks for `WerFault.exe` accessing `lsass.exe` with a specific access mask (`0x1FFFFF`), which is indicative of memory dumping tools like Mimikatz, NanoDump, Invoke-Mimikatz, Procdump, or Taskmgr. This technique is often used by adversaries to extract credentials for lateral movement or persistence.
Detects the execution of `reg.exe` to modify registry keys associated with Remote Desktop Protocol (RDP) settings. This includes attempts to enable/disable RDP or alter its behavior by tampering with values under `CurrentControlSet\Control\Terminal Server`, such as those related to concurrent sessions, RDP-TCP configurations, and other connection parameters. This activity can indicate an adversary attempting to establish persistence, facilitate lateral movement, or otherwise manipulate RDP access.
This rule detects the execution of PowerShell commands that utilize the `FromBase64String` function. This function is commonly used by adversaries to decode base64 encoded strings, which often contain obfuscated malicious commands or payloads. The rule specifically looks for the string `::frombase64string(` in the command line arguments of a process.
This rule detects the presence of keywords related to LSASS (Local Security Authority Subsystem Service) memory dumping in process command lines. Adversaries often dump LSASS memory to extract credentials such as plaintext passwords, NTLM hashes, and Kerberos tickets. The rule specifically looks for combinations of "lsass" with dump file extensions like ".dmp", ".zip", ".rar", or other common dump-related keywords like "lsassdump", "lsassdmp", "nanodump", and "sqldmpr". This activity is a strong indicator of an attempt to steal credentials from the system.
Detects the suspicious execution of `certreq.exe` with specific command-line arguments that indicate an attempt to download files. This technique is documented in LOLBAS (Living Off The Land Binaries and Scripts) as a method for adversaries to transfer files into a compromised environment, bypassing traditional security controls.
This rule detects the execution of the Notepad++ updater utility (GUP.exe) when it is launched by a process other than Notepad++ itself, and is used to download files from the internet. Specifically, it looks for GUP.exe being executed with command-line arguments indicating an unzip operation ('-unzipto') and a URL ('http'), while ensuring the parent process is not Notepad++. This behavior can indicate an adversary abusing a legitimate utility for ingress tool transfer.
Identifies the creation of local users via the net.exe command. This rule specifically looks for process creation events where 'net.exe' or 'net1.exe' is executed with the 'user' and 'add' arguments in the command line.
This rule detects the creation of files with specific names or patterns commonly used by memory dumping tools to extract credentials from the Local Security Authority Subsystem Service (LSASS) process memory. The rule looks for file creation events where the file path contains keywords like 'lsass', 'nanodump', 'sqldmpr', or specific filenames such as 'Andrew.dmp', 'Coredump.dmp', 'lsass.dmp', 'lsass.rar', 'lsass.zip', 'NotLSASS.zip', 'PPLBlade.dmp', and 'rustive.dmp'. This activity is indicative of an attempt to dump LSASS memory, which contains sensitive user credentials.
This rule detects suspicious PowerShell commands used to download files or content from the web. It specifically looks for the use of '.DownloadString(', '.DownloadFile(', 'Invoke-WebRequest', or 'iwr' within the process command line. These methods are commonly abused by adversaries to retrieve malicious payloads or scripts.
This rule detects attempts to discover local user accounts and system owner/user information using various Windows command-line utilities. It specifically looks for the execution of `cmd.exe` with `dir \users\` (excluding `rmdir`), `net.exe` or `net1.exe` with `user` (excluding common account management actions), `whoami.exe`, `quser.exe`, `qwinsta.exe`, `wmic.exe` with `useraccount get`, and `cmdkey.exe` with `/l`. These commands are frequently used by adversaries to gain situational awareness about the system's users.
Page 12 of 76