Google SecOps (@GoogleSecOps)

IOC Domain C2

YARA-L

Detect DNS events that indicate communication to a C2 domain in MISP

Google SecOps@GoogleSecOps

Google SecOps Detection Rules

1 year ago

003

Logins From Terminated Employees

YARA-L

Allowed Logins from Terminated Employees

Google SecOps@GoogleSecOps

Google SecOps Detection Rules

1 year ago

002

MITRE ATT&CK T1021.002 Windows Admin Share With User Enrichment

YARA-L

Net use commands for SMB/Windows admin shares focused on UDM enriched user fields

Google SecOps@GoogleSecOps

Google SecOps Detection Rules

1 year ago

002

MITRE ATT&CK T1570 Suspicious Command PSExec

YARA-L

Command-line execution of the PsExec tool on Windows

Google SecOps@GoogleSecOps

Google SecOps Detection Rules

1 year ago

002

MITRE ATT&CK T1003.003 RW Utilities Associated With Ntds.dit

YARA-L

Detects process launches from processes related to ntds against key servers

Google SecOps@GoogleSecOps

Google SecOps Detection Rules

1 year ago

002

Hash Prevalence

YARA-L

Correlate process events with hashes that have a low rolling max over the past 10 days

Google SecOps@GoogleSecOps

Google SecOps Detection Rules

1 year ago

302

IOC IP Target

YARA-L

Detect network events that indicate communication to a watchlisted IP address

Google SecOps@GoogleSecOps

Google SecOps Detection Rules

1 year ago

002

Network HTTP Low Prevalence Domain Access

YARA-L

Detects network web access to a low prevalence domain

Google SecOps@GoogleSecOps

Google SecOps Detection Rules

1 year ago

002

Process Launch VT Enrichment

YARA-L

Identify process creations that are tagged exploit in VT

Google SecOps@GoogleSecOps

Google SecOps Detection Rules

1 year ago

002

VT Relationships File Contacts Domain

YARA-L

Alert on known Hash querying a known hostname with VT Relationships

Google SecOps@GoogleSecOps

Google SecOps Detection Rules

1 year ago

002

Google SecOps

Filters

Last updated

Detection languages

Categories

Platforms

Products / Services

MITRE Techniques

CVEs

IOC Domain C2

Logins From Terminated Employees

MITRE ATT&CK T1021.002 Windows Admin Share With User Enrichment

MITRE ATT&CK T1570 Suspicious Command PSExec

MITRE ATT&CK T1003.003 RW Utilities Associated With Ntds.dit

Hash Prevalence

IOC IP Target

Network HTTP Low Prevalence Domain Access

Process Launch VT Enrichment

VT Relationships File Contacts Domain

Google SecOps

Filters

Last updated

Detection languages

Categories

Platforms

Products / Services

MITRE Techniques

CVEs

IOC Domain C2

Logins From Terminated Employees

MITRE ATT&amp;CK T1021.002 Windows Admin Share With User Enrichment

MITRE ATT&amp;CK T1570 Suspicious Command PSExec

MITRE ATT&amp;CK T1003.003 RW Utilities Associated With Ntds.dit

Hash Prevalence

IOC IP Target

Network HTTP Low Prevalence Domain Access

Process Launch VT Enrichment

VT Relationships File Contacts Domain

MITRE ATT&CK T1021.002 Windows Admin Share With User Enrichment

MITRE ATT&CK T1570 Suspicious Command PSExec

MITRE ATT&CK T1003.003 RW Utilities Associated With Ntds.dit