Google SecOps
@GoogleSecOps4 followers1,217 downloads359 copies1 like18,019 views
727 detections
Filters
Last updated
All Time
Detection languages
725
2
Categories
187
173
109
81
75
Platforms
245
187
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
223
173
97
92
75
CVEs
4
4
This rule detects successful user logins where the user's termination date is in the past, indicating a login from a terminated employee. This could signify unauthorized access or a failure in account deprovisioning processes. The rule requires a context data source that provides user termination dates, such as Azure AD Context or Workday.
This rule detects outbound network connections to IP addresses that have been observed for the first time within the last 24 hours. It specifically excludes connections to private IP address ranges (RFC1918). The detection relies on correlating current network connection events with historical 'first seen' data for IP addresses from an entity graph.
This rule detects attempts to access domains that have been registered within the last 30 days. It correlates network HTTP or generic network connection events with WHOIS data to identify recently created domains. The rule leverages WHOIS enrichment to determine the creation time of the accessed domain and flags any access to domains created within the specified 30-day window.
This rule detects a sequence of multiple failed login attempts (more than 4) followed by a successful login for the same user on the same hostname within a 15-minute window. It specifically targets Windows login events (event IDs 4625 for failure and 4624 for success) and correlates them with user and asset entity data, focusing on users in the 'Domain Admins' group and assets that are 'Domain Controllers'. This pattern is indicative of a brute-force attack or password guessing attempt that eventually succeeded.
This rule detects suspicious activity following a successful login to the Azure AD PowerShell application. Specifically, it looks for a user performing multiple administrative actions within a short timeframe after logging in. These actions include adding or updating applications, adding delegated permission grants, or managing certificates and secrets for applications. This behavior is indicative of an attacker attempting to establish persistence or escalate privileges within an Entra ID environment after initial access.
Detects the execution of Impacket's wmiexec.py tool by identifying characteristic command-line arguments and temporary file creation patterns. Specifically, it looks for process launches with command lines redirecting output to a hidden ADMIN$ share path (e.g., `1>\ADMIN$\__... 2>&1`) or the creation of files in the `\windows\__` directory, which are common artifacts left by wmiexec.py.
This rule detects the execution of specific 'net group' and 'net localgroup' commands that are commonly used for Active Directory enumeration. These commands are often leveraged by adversaries to discover domain-level groups, local administrator groups, and domain administrator groups, which can help them identify privileged accounts and plan further attacks. The rule is designed to flag multiple occurrences of these commands within a 15-minute window on a single host, as a single execution might be benign, but repeated executions suggest reconnaissance activity. The detection logic specifically looks for 'net localgroup administrators', 'net group /dom', and 'net group Domain Admins /dom', optionally preceded by 'cmd /c'.
Detects attempts to clear Windows Event Logs using 'wevtutil' command-line utility or PowerShell cmdlets like 'Remove-EventLog' and 'Clear-EventLog'. This activity is often performed by adversaries to remove forensic evidence of their actions on a compromised system.
This rule detects when a user, identified as having a high-risk relationship with GCP resources (specifically those containing sensitive data like US Social Security Numbers via GCP DLP context), downloads an executable file. The detection correlates network proxy events showing executable downloads or large file transfers with EDR events indicating Microsoft Excel activity on the same host and by the same user within a 5-minute window. This scenario is indicative of a potential malicious macro in an Excel document downloading and executing malware.
This rule detects PowerShell commands that utilize encoded arguments such as '-enc', '-ec', or '-en'. Adversaries often use encoded PowerShell commands to obfuscate their malicious scripts, making it harder for security tools and analysts to detect and understand their activities. The rule specifically looks for the execution of 'powershell.exe' or 'powershell_ise.exe' with these encoding flags and attempts to capture and decode the obfuscated command.
Page 13 of 73