Google SecOps
@GoogleSecOps4 followers1,217 downloads359 copies1 like18,019 views
727 detections
Filters
Last updated
All Time
Detection languages
725
2
Categories
187
173
109
81
75
Platforms
245
187
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
223
173
97
92
75
CVEs
4
4
Detects the use of powershell to enumerate successful logins on a specific host
Detect Multiple Failed Login Attempts followed by Successful Login
Detects extraction of ntds.dit file using vssadmin.exe or ntdsutil.exe with wmic as identified in CISA Living off the Land pdf
Executable downloaded by Microsoft Excel by user with GCP entity relationship
GCTI Remote Access Tools
YARA-L
Alert process and file create events that are associated with hashes from the GCTI Remote Access Tool list
GCTI Tor Exit Nodes
YARA-L
Alert traffic destined for known Tor exit nodes
Detection of process/file events that match Safe Browsing hashes, which are files deemed to be malicious
Detect network connection to an ip address that was only seen for the first time in the past 24 hours
Alert on known Hash contacting Tor IP with VT Relationships.
Alert on downloading a known file hash from a known IP with VT Relationships.
Page 24 of 73