Google SecOps
@GoogleSecOps4 followers1,217 downloads359 copies1 like18,019 views
727 detections
Filters
Last updated
All Time
Detection languages
725
2
Categories
187
173
109
81
75
Platforms
245
187
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
223
173
97
92
75
CVEs
4
4
ADFS DKM Key Access
YARA-L
Detects access to the AD contact object to read the AD FS DKM (distributed key manager) master key value
Adding users to administrative roles is not malicious, but due to the sensitivity of certain roles, validation should occur when this occurs
Detects the artifacts generally associated with the use of wmiexec.py
Net use commands for SMB/Windows admin shares based on asset entity group
Net use commands for SMB/Windows admin shares focused on specific user entity characteristics
Creation of scheduled task using command line
Detects encoded powershell commands
Detects suspicious credential access commands as identified in CISA Living off the Land pdf. Alone they may be normal but in concert, they may be worth looking into
Detects group enumeration commands as identified in CISA Living off the Land pdf. Alone they may be normal but in concert, they may be worth looking into
Detects suspicious commands as identified in CISA Living off the Land pdf. Alone they may be normal but in concert, they may be worth looking into
Page 25 of 73