Google SecOps
@GoogleSecOps4 followers1,217 downloads379 copies1 like18,177 views
758 detections
Filters
Last updated
All Time
Detection languages
756
2
Categories
189
188
109
81
77
Platforms
257
198
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
237
181
109
95
79
CVEs
4
4
Detect process launch events that correlate to Safe Browsing hash data and have low prevalence
IOC Hash Prevalence
YARA-L
Detect process/file events that match hashes found in our MISP instance and have low rolling max prevalence
IOC SHA256 Hash
YARA-L
Detect file/process events that match watchlisted hashes in MISP
IOC SHA256 Hash VT
YARA-L
Detect file/process events with watchlisted hashes from MISP that VT flagged as MS Office docx file types
IP Target Prevalence
YARA-L
Detect events that are communicating to IP addresses that have a low rolling max prevalence.
Identify process and file creation using safe browsing hashes where the first and last seen are more than 7 days apart
Alert on known Hash contacting known IP with VT Relationships
Alert on known File Hash executing known File Hash with VT Relationships.
Detect web traffic to a recently expired domain followed by an exe file creation event
Detects strong indicators of a successful device code phishing attack.
Page 30 of 76