Google SecOps
@GoogleSecOps4 followers1,217 downloads379 copies1 like18,177 views
758 detections
Filters
Last updated
All Time
Detection languages
756
2
Categories
189
188
109
81
77
Platforms
257
198
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
237
181
109
95
79
CVEs
4
4
CreateDump Process Dump
YARA-L
Detects uses of the createdump.exe LOLOBIN utility to dump process memory
Detects process LSASS memory dump using Mimikatz, NanoDump, Invoke-Mimikatz, Procdump or Taskmgr based on the CallTrace pointing to ntdll.dll, dbghelp.dll or dbgcore.dll for win10, server2016 and up
Detects execution of the Notepad++ updater (gup) from a process other than Notepad++ to download files
Detects the use of Windows Defender MpCmdRun.EXE to download files
Detects the creation of the default dump file used by Outflank Dumpert tool. A process dumper, which dumps the lsass process memory
Detects the use of Dumpert process dumper, which dumps the lsass.exe process memory
Detects process access requests from hacktool processes based on their default image name
Detection well-known mimikatz command line arguments
Local Accounts Discovery
YARA-L
Local accounts, System Owner/User discovery using operating systems utilities
Detects the presence of the keywords lsass and .dmp in the commandline, which could indicate a potential attempt to dump or create a dump of the lsass process
Page 25 of 76