Google SecOps
@GoogleSecOps4 followers1,217 downloads379 copies1 like18,177 views
758 detections
Filters
Last updated
All Time
Detection languages
756
2
Categories
189
188
109
81
77
Platforms
257
198
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
237
181
109
95
79
CVEs
4
4
Detects suspicious usage of `curl.exe` on Windows to download files into common temporary or user-controlled directories. This rule specifically looks for `curl.exe` being executed and writing its output to locations like `%appdata%`, `%public%`, `%temp%`, user desktop, or common temporary system directories, often associated with malware staging or persistence. It also identifies downloads of specific file extensions commonly used for malicious payloads.
This rule detects attempts to access the Local Security Authority Subsystem Service (LSASS) process memory by other processes. Specifically, it triggers when a process attempts to open lsass.exe and the accessing process's image name (full path) contains the keyword "dump". This behavior is indicative of tools used for credential dumping, such as Mimikatz or similar utilities, which often include "dump" in their filenames or paths.
Detects the execution of certutil.exe with specific flags ('urlcache' or 'verifyctl') to download files from known file-sharing or content delivery network (CDN) websites. This technique is often used by adversaries for ingress tool transfer or to retrieve malicious payloads.
This rule detects attempts to dump process memory, specifically targeting the Local Security Authority Subsystem Service (LSASS) process, using `rundll32.exe` and `comsvcs.dll`. This technique is commonly used by adversaries to extract credentials from memory. The rule looks for `rundll32.exe` executing with `comsvcs.dll` and specific keywords like 'full', 'minidump', or numerical arguments (e.g., '24', '#-') that indicate a memory dump operation.
This rule detects the execution of the `createdump.exe` utility, or a renamed version of it, when used to dump process memory. It specifically looks for command-line arguments indicative of memory dumping, such as combinations of `-u`, `-f`, and `.dmp` or `--full`, `--name`, and `.dmp`. The rule explicitly excludes instances where the executable is named `createdump.exe` to focus on renamed binaries, which is a common evasion technique.
Detects the execution of `certutil.exe` with specific command-line arguments (`urlcache` or `verifyctl`) combined with an HTTP URL, indicating an attempt to download files using this utility. This technique is often used by adversaries for ingress tool transfer or to retrieve malicious payloads.
This rule detects attempts by known hacktool processes to access other processes. It specifically looks for 'PROCESS_OPEN' events where the principal process's image name matches a predefined list of hacktool patterns. This behavior is often indicative of credential dumping or other malicious activities where a tool needs to interact with another process's memory space, such as LSASS.
Detects the execution of Dumpert, a tool used to dump the memory of the Local Security Authority Subsystem Service (LSASS) process. This rule identifies Dumpert activity by looking for specific import hashes (imphash) associated with the tool or by detecting the string "dumpert.dll" in the command line of a launched process.
This rule detects repeated authentication failures from a single hostname targeting multiple distinct user accounts within a 30-minute window. This behavior is indicative of a password spraying attack, where an adversary attempts to use a small set of common passwords against many accounts to avoid account lockouts on a single account.
This rule detects the execution or creation of files identified as Remote Access Tools (RATs) based on a Google Cloud Threat Intelligence (GCTI) feed. It correlates process launch, module load, or file creation events with known SHA256 hashes of RATs provided by the GCTI feed. The rule specifically looks for events where the SHA256 hash of the process or file matches a hash from the 'Remote Access Tools' threat feed within the GCTI graph.
Page 15 of 76