Google SecOps
@GoogleSecOps4 followers1,217 downloads359 copies1 like18,019 views
727 detections
Filters
Last updated
All Time
Detection languages
725
2
Categories
187
173
109
81
75
Platforms
245
187
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
223
173
97
92
75
CVEs
4
4
Detects the use of Dumpert process dumper, which dumps the lsass.exe process memory
Detects process access requests from hacktool processes based on their default image name
Detection well-known mimikatz command line arguments
Local Accounts Discovery
YARA-L
Local accounts, System Owner/User discovery using operating systems utilities
Detects the presence of the keywords lsass and .dmp in the commandline, which could indicate a potential attempt to dump or create a dump of the lsass process
Detects LSASS process access requests from a source process with the dump keyword in its image name
Detects the creation of an lsass.dmp file by the taskmgr process. This indicates a manual dumping of the LSASS.exe process memory using Windows Task Manager
Identifies the creation of local users via the net.exe command
Detects the execution of reg.exe for enabling/disabling the RDP service on the host by tampering with the CurrentControlSet\\Control\\Terminal Server values
PowerShell DownloadFile
YARA-L
Detects the execution of powershell, a WebClient object creation and the invocation of DownloadFile in a single command line
Page 22 of 73