Google SecOps
@GoogleSecOps4 followers1,217 downloads359 copies1 like18,019 views
727 detections
Filters
Last updated
All Time
Detection languages
725
2
Categories
187
173
109
81
75
Platforms
245
187
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
223
173
97
92
75
CVEs
4
4
This rule detects various network enumeration commands commonly used by adversaries for reconnaissance, as identified in the CISA Living off the Land report. It specifically looks for commands like 'arp -a', 'curl www.ip-api.com', 'dnscmd /enumrecords', 'dnscmd /enumzones', 'ipconfig /all', 'netsh' commands related to firewall and portproxy, and 'netstat -ano'. Additionally, it detects DNS queries for 'www.ip-api.com', which can be indicative of C2 frameworks like Covenant attempting to check for internet connectivity or external IP addresses.
This rule detects outbound network connections to IP addresses that exhibit low prevalence within the monitored environment. Specifically, it flags connections to IPs that have a rolling maximum prevalence of 1 to 3 occurrences over a 10-day period. This behavior can be indicative of command and control (C2) communication, data exfiltration, or other suspicious activities where adversaries might use newly registered or rarely seen infrastructure.
This rule detects outbound network connections to known Tor exit nodes. It leverages a Google Cloud Threat Intelligence (GCTI) feed that provides a list of current Tor exit node IP addresses. The rule specifically looks for allowed network connections where the target IP address is identified as a Tor exit node by the GCTI feed. This can indicate an attempt to anonymize network traffic, which is often associated with malicious activity.
This rule detects various system enumeration commands commonly used by adversaries for reconnaissance, as identified in a CISA "Living off the Land" report. The rule looks for the execution of utilities like `wevtutil`, `ldifde.exe`, `reg query`, `systeminfo`, `tasklist`, `whoami`, and `wmic` with specific arguments that indicate system information discovery. While these commands can be benign, their frequent or combined execution on a single host within a 15-minute window (more than 5 distinct command lines) can be indicative of malicious activity.
This rule detects network connections initiated by a file whose SHA256 hash is known, via VirusTotal relationships, to contact a specific IP address. It correlates network connection events with VirusTotal intelligence to identify potentially malicious communication.
This rule detects when a file is downloaded via HTTP and subsequently created on a system, where the file's SHA256 hash and the URL it was downloaded from are identified as malicious through VirusTotal relationships. It correlates HTTP network events with file creation events, ensuring the download precedes the file creation, and then enriches this information with VirusTotal data to confirm the malicious nature of the file and its source URL.
This rule detects the use of the `netsh interface portproxy` command to enable port forwarding, specifically looking for `v4tov4` configurations. It also identifies the creation or modification of associated registry settings under `HKLM\System\CurrentControlSet\Services\PortProxy\v4tov4`, which are indicative of port proxying being configured on a Windows system.
This rule detects suspicious command-line executions on Windows systems, as identified in a CISA 'Living off the Land' report. The rule looks for specific patterns in process command lines that, while potentially benign in isolation, could indicate reconnaissance, lateral movement, or data staging activities when observed in concert. Examples include the use of 7-Zip for archiving with a password, specific `pcwrun.exe` or `rar.exe` commands, `ping` commands with unusual parameters or output redirection, `dir` commands targeting network shares, `wmic` commands for process creation or `whoami` execution, `net use` commands for IPC shares, `xcopy` for data movement, and PowerShell commands to launch hidden batch files.
This rule detects the execution of the Mimikatz tool by looking for the string "mimikatz" (case-insensitive) in the command line of newly launched processes. Mimikatz is a well-known credential dumping tool often used by adversaries to extract plaintext passwords, hash, PIN codes, and Kerberos tickets from memory.
This rule detects a pattern of multiple failed login attempts followed by a successful login for the same user on the same hostname within a 15-minute window. This behavior is indicative of a brute-force attack or password guessing attempt that eventually succeeded.
Page 14 of 73