Google SecOps
@GoogleSecOps4 followers1,217 downloads379 copies1 like18,177 views
758 detections
Filters
Last updated
All Time
Detection languages
756
2
Categories
189
188
109
81
77
Platforms
257
198
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
237
181
109
95
79
CVEs
4
4
IOC IP Target
YARA-L
Detect network events that indicate communication to a watchlisted IP address
Detect network connection to an ip address that was only seen for the first time in the past 24 hours
Identify process creations that are tagged exploit in VT
Alert on known Hash querying a known hostname with VT Relationships
Alert on downloading a known file hash from a known IP with VT Relationships.
Example usage of WHOIS data, detecting an executable file download from a domain that's recently expired
Detects access attempts to a newly created domain via WHOIS enrichment.
Detects usage of the \"FromBase64String\" function in the commandline which is used to decode a base64 encoded string
Detects usage of the \"ConvertTo-SecureString\" cmdlet via the commandline. Which is fairly uncommon and could indicate potential suspicious activity
Detects a copy command or a copy utility execution to or from an Admin share or remote
Page 24 of 76