Google SecOps
@GoogleSecOps4 followers1,217 downloads359 copies1 like18,019 views
727 detections
Filters
Last updated
All Time
Detection languages
725
2
Categories
187
173
109
81
75
Platforms
245
187
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
223
173
97
92
75
CVEs
4
4
Detects the execution of the Windows LOLBIN (Living Off the Land Binary) PrintBrm.exe with command-line arguments indicating the creation or extraction of ZIP files. This activity is considered suspicious on a normal workstation as PrintBrm.exe is typically used for printer migration and not for general file archiving.
Detects the execution of certutil.exe with specific flags ('urlcache' or 'verifyctl') to download files from known file-sharing or content delivery network (CDN) websites. This technique is often used by adversaries for ingress tool transfer or to retrieve malicious payloads.
This rule detects attempts to dump process memory, specifically targeting the Local Security Authority Subsystem Service (LSASS) process, using `rundll32.exe` and `comsvcs.dll`. This technique is commonly used by adversaries to extract credentials from memory. The rule looks for `rundll32.exe` executing with `comsvcs.dll` and specific keywords like 'full', 'minidump', or numerical arguments (e.g., '24', '#-') that indicate a memory dump operation.
This rule detects the execution of the `createdump.exe` utility, or a renamed version of it, when used to dump process memory. It specifically looks for command-line arguments indicative of memory dumping, such as combinations of `-u`, `-f`, and `.dmp` or `--full`, `--name`, and `.dmp`. The rule explicitly excludes instances where the executable is named `createdump.exe` to focus on renamed binaries, which is a common evasion technique.
Detects the execution of `certutil.exe` with specific command-line arguments (`urlcache` or `verifyctl`) combined with an HTTP URL, indicating an attempt to download files using this utility. This technique is often used by adversaries for ingress tool transfer or to retrieve malicious payloads.
This rule detects attempts by known hacktool processes to access other processes. It specifically looks for 'PROCESS_OPEN' events where the principal process's image name matches a predefined list of hacktool patterns. This behavior is often indicative of credential dumping or other malicious activities where a tool needs to interact with another process's memory space, such as LSASS.
Detects the execution of Dumpert, a tool used to dump the memory of the Local Security Authority Subsystem Service (LSASS) process. This rule identifies Dumpert activity by looking for specific import hashes (imphash) associated with the tool or by detecting the string "dumpert.dll" in the command line of a launched process.
This rule detects repeated authentication failures from a single hostname targeting multiple distinct user accounts within a 30-minute window. This behavior is indicative of a password spraying attack, where an adversary attempts to use a small set of common passwords against many accounts to avoid account lockouts on a single account.
This rule detects the execution or creation of files identified as Remote Access Tools (RATs) based on a Google Cloud Threat Intelligence (GCTI) feed. It correlates process launch, module load, or file creation events with known SHA256 hashes of RATs provided by the GCTI feed. The rule specifically looks for events where the SHA256 hash of the process or file matches a hash from the 'Remote Access Tools' threat feed within the GCTI graph.
This rule detects when a file, identified as malicious by Google Safe Browsing, initiates an outbound network connection to an IP address known to be a Tor Exit Node, as identified by Google Cloud Threat Intelligence (GCTI) Feed. This indicates potential command and control (C2) communication or data exfiltration by malware attempting to anonymize its network traffic.
Page 12 of 73