Google SecOps
@GoogleSecOps4 followers1,217 downloads359 copies1 like18,019 views
727 detections
Filters
Last updated
All Time
Detection languages
725
2
Categories
187
173
109
81
75
Platforms
245
187
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
223
173
97
92
75
CVEs
4
4
This rule detects a sequence of events indicating the creation of a user account, a successful login by that user, and the subsequent deletion of the same user account within a 4-hour timeframe. This pattern is often indicative of an adversary creating temporary accounts for malicious activities, using them, and then removing them to cover their tracks or evade detection. The rule specifically targets Windows login events (event code 4624).
This rule detects the launch of processes whose executable files are identified as malicious by Google Safe Browsing and exhibit low prevalence within the environment. Specifically, it looks for process launch events where the SHA256 hash of the executable matches a hash flagged as 'CRITICAL' severity by Google Safe Browsing. Additionally, the rule filters for executables that have been observed on a maximum of 3 distinct machines over a 10-day rolling period, indicating low prevalence and a higher likelihood of being a targeted or novel threat.
This rule detects the use of the 'net use' command to connect to Windows administrative shares (C$, ADMIN$, IPC$) by users who are members of the 'Domain Admins' group. It specifically looks for process launch events where the command line contains 'net use' followed by one of the administrative share names. The rule correlates this activity with user entity data to identify if the executing user is part of the 'Domain Admins' group, indicating potential lateral movement or administrative activity.
Detects strong indicators of a successful device code phishing attack. This rule correlates email events containing Microsoft device login URLs with subsequent Microsoft Entra ID authentication attempts that result in a specific error code (50199 or 0), indicating the user was prompted to confirm the application. The time window for correlation is set to 16 minutes, accounting for the typical 15-minute expiration of device codes.
Detects the execution of certutil with certain flags that allow the utility to download files from file-sharing websites
Detect multiple user logins from multiple states or countries using Chronicle GeoIP enrichment.
SharpSuccessor is a .NET-based post-exploitation tool designed to weaponize the BadSuccessor attack discovered by Yuval Gordon (@YuG0rd) from Akamai. It allows a low-privileged user with 'CreateChild' permissions over any Organizational Unit (OU) in an Active Directory domain to escalate privileges to Domain Administrator. This detection rule identifies execution patterns or behavioral indicators linked to SharpSuccessor activity, which may signal privilege escalation attempts in Active Directory environments.
Detect DNS events that communicate with gaming sites in MISP. These violate policy.
Files with well-known filenames (parts of credential dump software or files produced by them) creation
Finger.EXE Execution
YARA-L
Detects execution of the finger.exe utility. Finger.EXE or \"TCPIP Finger Command\" is an old utility that is still present on modern Windows installation. It Displays information about users on a specified remote computer (typically a UNIX computer) that is running the finger service or daemon. Due to the old nature of this utility and the rareness of machines having the finger service. Any execution of finger.exe can be considered suspicious and worth investigating.
Page 18 of 73