Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,374 downloads4,081 copies490 likes318,452 views
919 detections
Filters
Last updated
All Time
Detection languages
328
314
163
59
21
Categories
261
235
219
212
173
Platforms
417
384
97
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
299
272
245
191
185
CVEs
6
4
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects the Trigram (Kimsuky/UNK_DeadDrop, OverLord) Windows dropper pattern where cmd.exe or PowerShell strips the Mark-of-the-Web via Unblock-File or Zone.Identifier removal, followed on the same host by the execution of a hidden VBScript worker using wscript //B.
Detects SleepyDuck evjawbreaker Go RAT Linux persistence: a systemd user unit solidity-langsupport-runner.service written under ~/.config/systemd/user and enabled via systemctl --user from a /bin/sh -lc shell, within a short window on the same host.
Detects a successful sshd password login followed within 10 minutes on the same host by root escalation via doas/sudo, user creation, or authorized_keys modification by the same user. Targets post-exploitation of the OpenSSH musl/no-PAM password authentication bypass (*sshole, CVE-2026-123158).
Detects mshta.exe launched with an inline javascript: one-liner that chains MSXML2.XMLHTTP to download, ADODB.Stream to write to disk, and WScript.Shell to execute. This identifies the ClickFix social engineering variant that fetches and executes payloads without using PowerShell.
Detects browser cache smuggling (ClickFix/FileFix delivery mechanisms) where a non-browser script interpreter or LOLBin accesses a browser HTTP-cache directory and writes an executable or script payload outside the cache, followed shortly by the execution of a payload from a user staging directory.
Detects a potential app-only tenant-takeover sequence associated with Storm-3119 (YAM Store), where a single service principal performs an administrative password reset, a license assignment, and a privileged role grant within a one-hour window.
Detects PowerShell launched hidden and non-interactive with an insecure execution policy and Base64 decode-and-execute, or a script combining Base64 decode-and-execute with browser history collection and WMI shadow copy enumeration, as seen in the Midnight Blizzard (GTG-20006) stager.
Detects a single application or service principal performing a password reset, a license assignment, and a privileged role grant within a one-hour window. This sequence matches Storm-3119 admin-panel abuse of a compromised tenant client secret through an app-only flow in Microsoft 365 or Entra ID.
Detects the WinLol Rust dropper staging a DLL sideload by writing a copy of Microsoft OneDrive.exe and a proxy version.dll into a user temp directory by a non-OneDrive, non-installer process.
Detects the execution of rundll32.exe loading a DLL directly from common browser cache directories (Firefox, Chrome, or Edge), which is indicative of the SensePost cache-smuggling proof-of-concept technique.
Page 1 of 92