Google SecOps
@GoogleSecOps4 followers1,217 downloads359 copies1 like18,019 views
727 detections
Filters
Last updated
All Time
Detection languages
725
2
Categories
187
173
109
81
75
Platforms
245
187
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
223
173
97
92
75
CVEs
4
4
This rule detects when an authorization token, initially observed in Google Kubernetes Engine (GKE) activity logs, is subsequently used within a command line on an endpoint system. This behavior suggests that a GKE pod's credential may have been exfiltrated and is being reused on a different system, potentially indicating unauthorized access or credential theft.
Detects a spike in undeliverable emails, this can be an early indication of a targeted phishing campaign or a compromised user account.
Alerts when an authorization token originating from GKE activity is subsequently used within a command line on an endpoint system, suggesting potential credential exfiltration and reuse.
This detection rule identifies the execution of uncommon or suspicious Remote Monitoring and Management (RMM) tools. While RMM tools are legitimate for IT administration, they are frequently abused by attackers, initial access brokers (IABs), and ransomware operators to establish persistent remote access, execute malicious commands, or deploy additional payloads. The rule specifically looks for process launches of various RMM software that might not be commonly observed in an environment, indicating potential unauthorized access or lateral movement. The list of RMM tools is informed by the LOL-RMM (Living Off the Land RMM) project.
This detection rule identifies the execution of WinPEAS (Windows Privilege Escalation Awesome Script), a post-exploitation reconnaissance tool used to discover privilege escalation paths on Windows systems. WinPEAS performs a wide range of local enumeration checks, including service misconfigurations, permission issues, token privileges, and more. Its usage is commonly observed during red team assessments and by adversaries seeking to elevate privileges after gaining initial access. The rule looks for common WinPEAS executable names, specific command-line arguments used by WinPEAS for various enumeration tasks, and patterns indicative of downloading WinPEAS PowerShell scripts from GitHub.
This detection rule identifies the execution of the Purple Knight tool, a free Active Directory security assessment utility developed by Semperis. Purple Knight is designed to scan for AD vulnerabilities, misconfigurations, and common attack paths. While it is a legitimate tool used by defenders, its execution in production environments may also indicate red team activity or unauthorized reconnaissance by adversaries attempting to map domain weaknesses.
Detects the execution of known attacker tools, specifically those associated with the IronSharpPack toolset. This rule identifies process launches where common command and scripting interpreters (cmd.exe, python, ipy.exe, powershell.exe, pwsh.exe, wsl.exe) are used to execute scripts or binaries with names indicative of IronSharpPack components. The presence of these tools in an unauthorized environment suggests malicious activity, often related to offensive security operations, post-exploitation, or privilege escalation.
This detection rule identifies the creation of a Windows service with a suspicious or known malicious name, as logged by Windows Event ID 7045 (`A service was installed in the system`). Threat actors often create services to achieve persistence, lateral movement, remote execution, or privilege escalation. Detection of such activity is critical for identifying early-stage post-compromise behavior.
This detection rule identifies the execution of the Purple Knight tool, a free Active Directory security assessment utility developed by Semperis. Purple Knight is designed to scan for AD vulnerabilities, misconfigurations, and common attack paths. While it is a legitimate tool used by defenders, its execution in production environments may also indicate red team activity or unauthorized reconnaissance by adversaries attempting to map domain weaknesses.
This detection rule identifies the execution of WinPEAS (Windows Privilege Escalation Awesome Script), a post-exploitation reconnaissance tool used to discover privilege escalation paths on Windows systems. WinPEAS performs a wide range of local enumeration checks, including service misconfigurations, permission issues, token privileges, and more. Its usage is commonly observed during red team assessments and by adversaries seeking to elevate privileges after gaining initial access. WinPEAS checks are well-documented in the HackTricks knowledge base.
Page 28 of 73