Google SecOps
@GoogleSecOps4 followers1,217 downloads359 copies1 like18,019 views
727 detections
Filters
Last updated
All Time
Detection languages
725
2
Categories
187
173
109
81
75
Platforms
245
187
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
223
173
97
92
75
CVEs
4
4
Detects the execution of `reg.exe` to modify registry keys associated with Remote Desktop Protocol (RDP) settings. This includes attempts to enable/disable RDP or alter its behavior by tampering with values under `CurrentControlSet\Control\Terminal Server`, such as those related to concurrent sessions, RDP-TCP configurations, and other connection parameters. This activity can indicate an adversary attempting to establish persistence, facilitate lateral movement, or otherwise manipulate RDP access.
This rule detects the execution of PowerShell commands that utilize the `FromBase64String` function. This function is commonly used by adversaries to decode base64 encoded strings, which often contain obfuscated malicious commands or payloads. The rule specifically looks for the string `::frombase64string(` in the command line arguments of a process.
Detects the suspicious execution of `certreq.exe` with specific command-line arguments that indicate an attempt to download files. This technique is documented in LOLBAS (Living Off The Land Binaries and Scripts) as a method for adversaries to transfer files into a compromised environment, bypassing traditional security controls.
This rule detects the execution of the Notepad++ updater utility (GUP.exe) when it is launched by a process other than Notepad++ itself, and is used to download files from the internet. Specifically, it looks for GUP.exe being executed with command-line arguments indicating an unzip operation ('-unzipto') and a URL ('http'), while ensuring the parent process is not Notepad++. This behavior can indicate an adversary abusing a legitimate utility for ingress tool transfer.
This rule detects the presence of keywords related to LSASS (Local Security Authority Subsystem Service) memory dumping in process command lines. Adversaries often dump LSASS memory to extract credentials such as plaintext passwords, NTLM hashes, and Kerberos tickets. The rule specifically looks for combinations of "lsass" with dump file extensions like ".dmp", ".zip", ".rar", or other common dump-related keywords like "lsassdump", "lsassdmp", "nanodump", and "sqldmpr". This activity is a strong indicator of an attempt to steal credentials from the system.
Identifies the creation of local users via the net.exe command. This rule specifically looks for process creation events where 'net.exe' or 'net1.exe' is executed with the 'user' and 'add' arguments in the command line.
This rule detects the creation of files with specific names or patterns commonly used by memory dumping tools to extract credentials from the Local Security Authority Subsystem Service (LSASS) process memory. The rule looks for file creation events where the file path contains keywords like 'lsass', 'nanodump', 'sqldmpr', or specific filenames such as 'Andrew.dmp', 'Coredump.dmp', 'lsass.dmp', 'lsass.rar', 'lsass.zip', 'NotLSASS.zip', 'PPLBlade.dmp', and 'rustive.dmp'. This activity is indicative of an attempt to dump LSASS memory, which contains sensitive user credentials.
This rule detects suspicious PowerShell commands used to download files or content from the web. It specifically looks for the use of '.DownloadString(', '.DownloadFile(', 'Invoke-WebRequest', or 'iwr' within the process command line. These methods are commonly abused by adversaries to retrieve malicious payloads or scripts.
This rule detects attempts to discover local user accounts and system owner/user information using various Windows command-line utilities. It specifically looks for the execution of `cmd.exe` with `dir \users\` (excluding `rmdir`), `net.exe` or `net1.exe` with `user` (excluding common account management actions), `whoami.exe`, `quser.exe`, `qwinsta.exe`, `wmic.exe` with `useraccount get`, and `cmdkey.exe` with `/l`. These commands are frequently used by adversaries to gain situational awareness about the system's users.
This rule detects the execution of `createdump.exe`, a legitimate utility, when it is used to dump process memory. The detection is based on the presence of specific command-line arguments such as '-u', '--full', '-f', '--name', or '.dmp', which are indicative of memory dumping operations. This activity is often associated with attempts to extract credentials or other sensitive information from running processes.
Page 9 of 73