Google SecOps
@GoogleSecOps4 followers1,217 downloads359 copies1 like18,019 views
727 detections
Filters
Last updated
All Time
Detection languages
725
2
Categories
187
173
109
81
75
Platforms
245
187
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
223
173
97
92
75
CVEs
4
4
IOC SHA256 Hash
YARA-L
Detect file/process events that match watchlisted hashes in MISP
IOC SHA256 Hash VT
YARA-L
Detect file/process events with watchlisted hashes from MISP that VT flagged as MS Office docx file types
IP Target Prevalence
YARA-L
Detect events that are communicating to IP addresses that have a low rolling max prevalence.
Identify process and file creation using safe browsing hashes where the first and last seen are more than 7 days apart
Alert on known Hash contacting known IP with VT Relationships
Alert on known File Hash executing known File Hash with VT Relationships.
Example usage of WHOIS data, detecting an executable file download from a domain that's recently expired
Detect web traffic to a recently expired domain followed by an exe file creation event
Detects strong indicators of a successful device code phishing attack.
This rule detects a significant increase in undeliverable emails for a specific user within a short timeframe. This pattern can indicate that a user's account has been compromised and is being used to send out a large volume of phishing or spam emails, leading to many bounce-back messages. It could also suggest a targeted phishing campaign where the sender's email address is being spoofed, and the legitimate user is receiving the undeliverable notifications.
Page 27 of 73