Google SecOps
@GoogleSecOps4 followers1,217 downloads379 copies1 like18,177 views
758 detections
Filters
Last updated
All Time
Detection languages
756
2
Categories
189
188
109
81
77
Platforms
257
198
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
237
181
109
95
79
CVEs
4
4
Detects group enumeration commands as identified in CISA Living off the Land pdf. Alone they may be normal but in concert, they may be worth looking into
Detects suspicious commands as identified in CISA Living off the Land pdf. Alone they may be normal but in concert, they may be worth looking into
Detects the process mimikatz being issued from the command line.
Detect repeated authentication failure with multiple users indicative of a password spray attack.
Whoami Execution
YARA-L
Detects the execution of whoami, which is often used by attackers after exploitation to establish what credentials they are logged in under
Detect Multiple Failed Login Attempts followed by Successful Login
Detects the creation, login, and deletion of a user account over a predefined timeframe
Detects the clearing of event logs within the Windows Event Viewer.
Alert on Benign Binary contacting a TOR IP
A malicious file contacting a known Tor Exit Node.
Page 29 of 76