Google SecOps
@GoogleSecOps4 followers1,217 downloads359 copies1 like18,019 views
727 detections
Filters
Last updated
All Time
Detection languages
725
2
Categories
187
173
109
81
75
Platforms
245
187
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
223
173
97
92
75
CVEs
4
4
Detects the execution of the LOLBIN PrintBrm.exe, which can be used to create or extract ZIP files. PrintBrm.exe should not be run on a normal workstation
PUA - Nimgrab Execution
YARA-L
Detects the usage of nimgrab, a tool bundled with the Nim programming framework and used for downloading files.
Detects uses of a renamed legitimate createdump.exe LOLOBIN utility to dump process memory
Detects a suspicious certreq execution taken from the LOLBAS examples, which can be abused to download (small) files
Detects a suspicious curl process start on Windows and outputs the requested document to a local file
Detects a suspicious call to Invoke-WebRequest cmdlet where the and output is located in a suspicious location
Detect the use of net use for SMB/Windows admin shares
Detects port forwarding being enabled using netsh command and registry settings created or modified in support of portproxy v4tov4
Detects network enumeration commands as identified in CISA Living off the Land pdf. Alone they may be normal but in concert, they may be worth looking into
Detects system enumeration events as identified in CISA Living off the Land pdf. Alone they may be normal but in concert, they may be worth looking into
Page 23 of 73