Google SecOps
@GoogleSecOps4 followers1,217 downloads359 copies1 like18,019 views
727 detections
Filters
Last updated
All Time
Detection languages
725
2
Categories
187
173
109
81
75
Platforms
245
187
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
223
173
97
92
75
CVEs
4
4
Alert on downloading a known file hash from a known IP with VT Relationships.
Detects access attempts to a newly created domain via WHOIS enrichment.
Detects usage of the \"FromBase64String\" function in the commandline which is used to decode a base64 encoded string
Detects usage of the \"ConvertTo-SecureString\" cmdlet via the commandline. Which is fairly uncommon and could indicate potential suspicious activity
Detects a copy command or a copy utility execution to or from an Admin share or remote
CreateDump Process Dump
YARA-L
Detects uses of the createdump.exe LOLOBIN utility to dump process memory
Detects process LSASS memory dump using Mimikatz, NanoDump, Invoke-Mimikatz, Procdump or Taskmgr based on the CallTrace pointing to ntdll.dll, dbghelp.dll or dbgcore.dll for win10, server2016 and up
Detects execution of the Notepad++ updater (gup) from a process other than Notepad++ to download files
Detects the use of Windows Defender MpCmdRun.EXE to download files
Detects the creation of the default dump file used by Outflank Dumpert tool. A process dumper, which dumps the lsass process memory
Page 21 of 73