Google SecOps
@GoogleSecOps4 followers1,217 downloads359 copies1 like18,019 views
727 detections
Filters
Last updated
All Time
Detection languages
725
2
Categories
187
173
109
81
75
Platforms
245
187
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
223
173
97
92
75
CVEs
4
4
Detects on the execution of an encoded powershell command with a parent process of w3wp.exe.
Detects on the execution arguments associated with cmd.exe invocations originating from an active ASP.NET webshell.
Detects the creation of a file containing 'spinstall0' in specific SharePoint LAYOUTS directories. This activity is a strong indicator of successful post-exploitation of the SharePoint Server vulnerability CVE-2025-53770, where an attacker has likely placed a web shell for persistent access.
Detects a command-line interpreter (cmd.exe or powershell.exe) writing a file to a SharePoint (\TEMPLATE\LAYOUTS) directory.
This rule detects changes to the Windows Registry key that controls the Remote Desktop Protocol (RDP) port number. Specifically, it triggers when the RDP port is modified from its default value of 3389 to any other port. This activity can be indicative of an adversary attempting to evade detection, bypass network filtering, or maintain persistence by configuring RDP to listen on a non-standard port.
Detects tampering of RDP Terminal Service/Server sensitive settings. Such as allowing unauthorized users access to a system via the 'fAllowUnsolicited' or enabling RDP via 'fDenyTSConnections'...etc
Detects modifications to specific registry keys under `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control` that are commonly used for autostart extensibility points (ASEPs). This includes keys related to Terminal Services, Security Providers, Safe Boot, Print Monitors/Providers, Network Provider Order, and LSA Authentication/Notification Packages. Such modifications can be indicative of persistence mechanisms used by adversaries.
Detects potential suspicious behavior using secedit.exe, specifically when it is used to export or modify the security policy. This could indicate an adversary attempting to understand or alter system security configurations for persistence, privilege escalation, or defense evasion.
This rule detects modifications to specific Windows Registry keys that are known to be used by BlackByte ransomware for privilege escalation and to prepare for lateral movement and encryption. Specifically, it looks for the setting of 'LocalAccountTokenFilterPolicy', 'EnableLinkedConnections', and 'LongPathsEnabled' to a DWORD value of '1'. These modifications can enable administrative shares for non-administrator accounts, allow for longer file paths, and potentially facilitate ransomware operations.
Detects tampering of RDP Terminal Service/Server sensitive settings by monitoring modifications to specific registry keys. This includes changes that could allow unauthorized users access via 'fAllowUnsolicited', or enabling RDP via 'fDenyTSConnections' by setting their values to 'DWORD (0x00000000)'.
Page 5 of 73