Google SecOps
@GoogleSecOps4 followers1,217 downloads379 copies1 like18,177 views
758 detections
Filters
Last updated
All Time
Detection languages
756
2
Categories
189
188
109
81
77
Platforms
257
198
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
237
181
109
95
79
CVEs
4
4
Detection of process/file events that match Safe Browsing hashes, which are files deemed to be malicious
Alert on known Hash contacting Tor IP with VT Relationships.
ADFS DKM Key Access
YARA-L
Detects access to the AD contact object to read the AD FS DKM (distributed key manager) master key value
Adding users to administrative roles is not malicious, but due to the sensitivity of certain roles, validation should occur when this occurs
Detects the artifacts generally associated with the use of wmiexec.py
Net use commands for SMB/Windows admin shares based on asset entity group
Net use commands for SMB/Windows admin shares focused on specific user entity characteristics
Creation of scheduled task using command line
Detects encoded powershell commands
Detects suspicious credential access commands as identified in CISA Living off the Land pdf. Alone they may be normal but in concert, they may be worth looking into
Page 28 of 76