Google SecOps
@GoogleSecOps4 followers1,217 downloads379 copies1 like18,177 views
758 detections
Filters
Last updated
All Time
Detection languages
756
2
Categories
189
188
109
81
77
Platforms
257
198
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
237
181
109
95
79
CVEs
4
4
This rule detects the creation of files with names commonly associated with credential dumping tools or files produced by them. It looks for specific filenames or patterns in the full path of newly created files, such as logs from fgdump, kirbi files, pwdump outputs, cachedump executables, procdump outputs, and Windows Credential Editor (WCE) related files. This indicates an attempt to extract credentials from the system.
Detects the use of the Windows Defender command-line utility, MpCmdRun.exe, to download files. This utility is typically used for managing Windows Defender, but adversaries can abuse its 'DownloadFile' function to retrieve arbitrary files from a specified URL, often for staging malicious payloads or tools.
Detects suspicious uses of the SysInternals Procdump utility by using specific command line parameters (`-ma` or `-mm`) in combination with the `lsass.exe` process. This rule aims to catch instances where an attacker might rename the Procdump executable but still uses its characteristic command-line arguments to dump LSASS memory. It covers scenarios described in atomic tests 1 and 8 related to Procdump memory dumping.
Detects the execution of copy commands or utilities (robocopy, xcopy, cmd copy, PowerShell Copy-Item/Move-Item) targeting or originating from Windows administrative shares (like C$, ADMIN$) or the SYSVOL folder. This activity can indicate lateral movement or data staging by an adversary.
SharpSuccessor is a .NET-based post-exploitation tool designed to weaponize the BadSuccessor attack. This rule detects the execution of SharpSuccessor.exe or command-line arguments containing 'SharpSuccessor' in process launch events or specific Windows Security Auditing events (EventCode 4673) indicating a privileged service call. This activity is indicative of privilege escalation attempts in Active Directory environments, specifically leveraging 'CreateChild' permissions over Organizational Units (OUs) to escalate privileges to Domain Administrator.
This rule detects the execution of the `finger.exe` utility on Windows systems. `finger.exe` is an old utility used to display information about users on a specified remote computer running the finger service. Given its age and the rarity of the finger service on modern systems, any execution of this utility is considered suspicious and warrants investigation.
This rule detects modifications to the Windows Registry related to the SilentProcessExit mechanism for the lsass.exe process. Specifically, it looks for changes in the registry key path 'microsoft\windows nt\currentversion\silentprocessexit\lsass.exe'. This technique can be abused by adversaries to configure a monitor program to dump the memory of the lsass.exe process, which often contains sensitive credential information.
Detects the use of the Microsoft Windows Resource Leak Diagnostic tool rdrleakdiag.exe to dump process memory. This tool can be abused by adversaries to extract sensitive information, such as credentials, from process memory.
Detects the execution of the Windows LOLBIN (Living Off the Land Binary) PrintBrm.exe with command-line arguments indicating the creation or extraction of ZIP files. This activity is considered suspicious on a normal workstation as PrintBrm.exe is typically used for printer migration and not for general file archiving.
This rule detects the execution of 'nimgrab.exe', a tool associated with the Nim programming framework, which is often used for downloading files. Detection is based on the process name 'nimgrab.exe' or specific file hashes (MD5, SHA256, Imphash) associated with known nimgrab binaries. This tool can be abused by adversaries for ingress tool transfer.
Page 14 of 76