Google SecOps
@GoogleSecOps4 followers1,217 downloads379 copies1 like18,177 views
758 detections
Filters
Last updated
All Time
Detection languages
756
2
Categories
189
188
109
81
77
Platforms
257
198
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
237
181
109
95
79
CVEs
4
4
Detects LSASS process access requests from a source process with the dump keyword in its image name
Detects the creation of an lsass.dmp file by the taskmgr process. This indicates a manual dumping of the LSASS.exe process memory using Windows Task Manager
Identifies the creation of local users via the net.exe command
Detects the execution of reg.exe for enabling/disabling the RDP service on the host by tampering with the CurrentControlSet\\Control\\Terminal Server values
PowerShell DownloadFile
YARA-L
Detects the execution of powershell, a WebClient object creation and the invocation of DownloadFile in a single command line
Detects the execution of the LOLBIN PrintBrm.exe, which can be used to create or extract ZIP files. PrintBrm.exe should not be run on a normal workstation
PUA - Nimgrab Execution
YARA-L
Detects the usage of nimgrab, a tool bundled with the Nim programming framework and used for downloading files.
Detects uses of a renamed legitimate createdump.exe LOLOBIN utility to dump process memory
Detects a suspicious curl process start on Windows and outputs the requested document to a local file
Detects a suspicious call to Invoke-WebRequest cmdlet where the and output is located in a suspicious location
Page 26 of 76