🧰 Google Security Operations

The items that name it 8

• ARMORY CASTLE Exploits BeyondTrust
  writeup2026-10-15It is written here as Google Security Operations (SecOps).

  Detection rules in the Mandiant Hunting, Frontline Threats and Intel Emerging Threats rule packs, including Echo Pipes Base64 To Shell, Base64 Encoded Shell Command Execution, Low Severity Endpoint Detection Cluster on Host, Suspicious Curl Download to tmp, Suspicious Curl Network Connection to Stag

• Investigating Ephemeral Supply Chain Tampering
  writeup2026-10-15It is written here as Google Security Operations (SecOps).

  Detection rules in the Mandiant Frontline Threats, Mandiant Hunting Rules and Applied Threat Intelligence - Curated Prioritization packs

• Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances
  writeup2026-09-29

  Mandiant Intel Emerging Threats rule pack with rules for SUID on the shell, httpd restart with permission change, NetScaler web directory file writes, Python Base64 in-memory execution, crontab path scrubbing, ns_monuploadd_err.pl log poisoning, DTLSv1.0 handshake failure or NSPPE crash, and masquer

• ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft
  writeup2026-09-25It is written here as Google Security Operations (Mandiant Frontline Threats rule pack).

  Detection rules: Oracle PeopleSoft Configuration Inspection, Sshpass Interactive File Deployment, Data Archiving or Compression via Zstd Utility, MeshCentral Command Execution via Meshctrl; Suspicious File Write to Web Application Archive Directory pending

• Financially Motivated Threat Actor BREEZE COMET Targets Brazil
  article2026-09-01It is written here as Google Security Operations (SecOps).

  Detection through the Mandiant Hunting Rules rule pack

• Going with the Flow(s): Distinct Clusters Target Individuals of Interest to Russia
  article2026-08-20It is written here as Google Security Operations (SecOps).

  Enterprise Plus customers get Applied Threat Intelligence (ATI) alerts, IoC matches contextualized by YARA-L rules, in the Curated Prioritization rule pack

• UNC6671 Rebrands: Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments
  article2026-08-06It is written here as Google Security Operations (SecOps).

  Provides detection rules in the Okta and Microsoft 365 rule packs for the vishing, MFA modification and programmatic streaming activity: Okta Admin Console Access Failure, Okta Suspicious Actions from Anonymized IP, O365 SharePoint Bulk File Access or Download via PowerShell, O365 SharePoint High Vo

• Orca Security: Incident Response Tools
  article2026-07-31

  Cloud SIEM (formerly Chronicle) combining high-volume retention with YARA-L detection engineering and included base SOAR capability from the Standard package up; 12 months of hot data retention on every package.