Google SecOps
@GoogleSecOps4 followers1,217 downloads379 copies1 like18,177 views
758 detections
Filters
Last updated
All Time
Detection languages
756
2
Categories
189
188
109
81
77
Platforms
257
198
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
237
181
109
95
79
CVEs
4
4
This rule detects the creation of new files or the launch of processes whose SHA256 hash matches an indicator of compromise (IOC) from a MISP feed. It correlates process launch or file creation events with known malicious SHA256 hashes ingested from MISP, indicating potential malware execution or presence on a system.
This rule detects when a process executes another process, and both the principal (parent) process's file hash and the target (child) process's file hash have known 'EXECUTES' relationships in VirusTotal. This indicates that VirusTotal has previously observed the parent process executing the child process, which could be a sign of malicious activity if the hashes are associated with known threats.
This rule detects the launch of processes whose executable files are identified as malicious by Google Safe Browsing and exhibit low prevalence within the environment. Specifically, it looks for process launch events where the SHA256 hash of the executable matches a hash flagged as 'CRITICAL' severity by Google Safe Browsing. Additionally, the rule filters for executables that have been observed on a maximum of 3 distinct machines over a 10-day rolling period, indicating low prevalence and a higher likelihood of being a targeted or novel threat.
This rule detects the use of the 'net use' command to connect to Windows administrative shares (C$, ADMIN$, IPC$) by users who are members of the 'Domain Admins' group. It specifically looks for process launch events where the command line contains 'net use' followed by one of the administrative share names. The rule correlates this activity with user entity data to identify if the executing user is part of the 'Domain Admins' group, indicating potential lateral movement or administrative activity.
Detects strong indicators of a successful device code phishing attack. This rule correlates email events containing Microsoft device login URLs with subsequent Microsoft Entra ID authentication attempts that result in a specific error code (50199 or 0), indicating the user was prompted to confirm the application. The time window for correlation is set to 16 minutes, accounting for the typical 15-minute expiration of device codes.
Detects the execution of certutil with certain flags that allow the utility to download files from file-sharing websites
Detect multiple user logins from multiple states or countries using Chronicle GeoIP enrichment.
SharpSuccessor is a .NET-based post-exploitation tool designed to weaponize the BadSuccessor attack discovered by Yuval Gordon (@YuG0rd) from Akamai. It allows a low-privileged user with 'CreateChild' permissions over any Organizational Unit (OU) in an Active Directory domain to escalate privileges to Domain Administrator. This detection rule identifies execution patterns or behavioral indicators linked to SharpSuccessor activity, which may signal privilege escalation attempts in Active Directory environments.
Detect DNS events that communicate with gaming sites in MISP. These violate policy.
Files with well-known filenames (parts of credential dump software or files produced by them) creation
Page 21 of 76