Google SecOps
@GoogleSecOps4 followers1,217 downloads379 copies1 like18,177 views
758 detections
Filters
Last updated
All Time
Detection languages
756
2
Categories
189
188
109
81
77
Platforms
257
198
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
237
181
109
95
79
CVEs
4
4
Detect the use of net use for SMB/Windows admin shares
Detects port forwarding being enabled using netsh command and registry settings created or modified in support of portproxy v4tov4
Detects network enumeration commands as identified in CISA Living off the Land pdf. Alone they may be normal but in concert, they may be worth looking into
Detects system enumeration events as identified in CISA Living off the Land pdf. Alone they may be normal but in concert, they may be worth looking into
Detects the use of powershell to enumerate successful logins on a specific host
Detect Multiple Failed Login Attempts followed by Successful Login
Detects extraction of ntds.dit file using vssadmin.exe or ntdsutil.exe with wmic as identified in CISA Living off the Land pdf
Executable downloaded by Microsoft Excel by user with GCP entity relationship
GCTI Remote Access Tools
YARA-L
Alert process and file create events that are associated with hashes from the GCTI Remote Access Tool list
GCTI Tor Exit Nodes
YARA-L
Alert traffic destined for known Tor exit nodes
Page 27 of 76