Google SecOps
@GoogleSecOps4 followers1,217 downloads359 copies1 like18,019 views
727 detections
Filters
Last updated
All Time
Detection languages
725
2
Categories
187
173
109
81
75
Platforms
245
187
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
223
173
97
92
75
CVEs
4
4
Detects suspicious uses of the SysInternals Procdump utility by using specific command line parameters (`-ma` or `-mm`) in combination with the `lsass.exe` process. This rule aims to catch instances where an attacker might rename the Procdump executable but still uses its characteristic command-line arguments to dump LSASS memory. It covers scenarios described in atomic tests 1 and 8 related to Procdump memory dumping.
This rule detects the creation of files with names commonly associated with credential dumping tools or files produced by them. It looks for specific filenames or patterns in the full path of newly created files, such as logs from fgdump, kirbi files, pwdump outputs, cachedump executables, procdump outputs, and Windows Credential Editor (WCE) related files. This indicates an attempt to extract credentials from the system.
SharpSuccessor is a .NET-based post-exploitation tool designed to weaponize the BadSuccessor attack. This rule detects the execution of SharpSuccessor.exe or command-line arguments containing 'SharpSuccessor' in process launch events or specific Windows Security Auditing events (EventCode 4673) indicating a privileged service call. This activity is indicative of privilege escalation attempts in Active Directory environments, specifically leveraging 'CreateChild' permissions over Organizational Units (OUs) to escalate privileges to Domain Administrator.
Detects the execution of copy commands or utilities (robocopy, xcopy, cmd copy, PowerShell Copy-Item/Move-Item) targeting or originating from Windows administrative shares (like C$, ADMIN$) or the SYSVOL folder. This activity can indicate lateral movement or data staging by an adversary.
Detects the use of the Microsoft Windows Resource Leak Diagnostic tool rdrleakdiag.exe to dump process memory. This tool can be abused by adversaries to extract sensitive information, such as credentials, from process memory.
This rule detects the execution of the `finger.exe` utility on Windows systems. `finger.exe` is an old utility used to display information about users on a specified remote computer running the finger service. Given its age and the rarity of the finger service on modern systems, any execution of this utility is considered suspicious and warrants investigation.
This rule detects modifications to the Windows Registry related to the SilentProcessExit mechanism for the lsass.exe process. Specifically, it looks for changes in the registry key path 'microsoft\windows nt\currentversion\silentprocessexit\lsass.exe'. This technique can be abused by adversaries to configure a monitor program to dump the memory of the lsass.exe process, which often contains sensitive credential information.
This rule detects the execution of 'nimgrab.exe', a tool associated with the Nim programming framework, which is often used for downloading files. Detection is based on the process name 'nimgrab.exe' or specific file hashes (MD5, SHA256, Imphash) associated with known nimgrab binaries. This tool can be abused by adversaries for ingress tool transfer.
Detects suspicious usage of `curl.exe` on Windows to download files into common temporary or user-controlled directories. This rule specifically looks for `curl.exe` being executed and writing its output to locations like `%appdata%`, `%public%`, `%temp%`, user desktop, or common temporary system directories, often associated with malware staging or persistence. It also identifies downloads of specific file extensions commonly used for malicious payloads.
This rule detects attempts to access the Local Security Authority Subsystem Service (LSASS) process memory by other processes. Specifically, it triggers when a process attempts to open lsass.exe and the accessing process's image name (full path) contains the keyword "dump". This behavior is indicative of tools used for credential dumping, such as Mimikatz or similar utilities, which often include "dump" in their filenames or paths.
Page 11 of 73