Google SecOps
@GoogleSecOps4 followers1,217 downloads359 copies1 like18,019 views
727 detections
Filters
Last updated
All Time
Detection languages
725
2
Categories
187
173
109
81
75
Platforms
245
187
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
223
173
97
92
75
CVEs
4
4
Detects the process mimikatz being issued from the command line.
Detect repeated authentication failure with multiple users indicative of a password spray attack.
Whoami Execution
YARA-L
Detects the execution of whoami, which is often used by attackers after exploitation to establish what credentials they are logged in under
Detect Multiple Failed Login Attempts followed by Successful Login
Detects the creation, login, and deletion of a user account over a predefined timeframe
Detects the clearing of event logs within the Windows Event Viewer.
Alert on Benign Binary contacting a TOR IP
A malicious file contacting a known Tor Exit Node.
Detect process launch events that correlate to Safe Browsing hash data and have low prevalence
IOC Hash Prevalence
YARA-L
Detect process/file events that match hashes found in our MISP instance and have low rolling max prevalence
Page 26 of 73