Google SecOps
@GoogleSecOps4 followers1,217 downloads379 copies1 like18,177 views
758 detections
Filters
Last updated
All Time
Detection languages
756
2
Categories
189
188
109
81
77
Platforms
257
198
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
237
181
109
95
79
CVEs
4
4
Detects the execution of certutil with certain flags that allow the utility to download files
Once a user authenticates to the Azure AD PowerShell application, if they take multiple admin actions indicative of establishing their own persistence with an Entra ID application within a portion of the access token time, alert for additional investigation
IOC Domain C2
YARA-L
Detect DNS events that indicate communication to a C2 domain in MISP
Detects network web access to a low prevalence domain
Alert on downloading a known file hash from a known IP with VT Relationships.
Allowed Logins from Terminated Employees
Net use commands for SMB/Windows admin shares focused on UDM enriched user fields
Command-line execution of the PsExec tool on Windows
Detects process launches from processes related to ntds against key servers
Hash Prevalence
YARA-L
Correlate process events with hashes that have a low rolling max over the past 10 days
Page 23 of 76