Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,374 downloads4,081 copies490 likes318,454 views
919 detections
Filters
Last updated
All Time
Detection languages
328
314
163
59
21
Categories
261
235
219
212
173
Platforms
417
384
97
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
299
272
245
191
185
CVEs
6
4
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects an NGINX worker process spawning a shell or interpreter process, the post-exploitation primitive for CVE-2026-42945 (NGINX Rift). The exploit chain corrupts the ngx_pool_t cleanup handler and triggers system() with attacker-controlled shell commands, causing the nginx worker to fork /bin/sh with the -c flag. Since system() always invokes /bin/sh -c, the highest-fidelity match is nginx → /bin/sh -c <command>. Generalizes to catch arbitrary interpreter spawning (bash, python, perl, ruby, netcat variants, socat) which would result from any future post-exploitation pivot. Scoped to Linux because the exploit relies on the fork-based multi-worker architecture (Linux/BSD only). Windows nginx is not affected by the heap feng shui exploitation primitive.
Detects modifications to the Windows registry that disable the
Microsoft Vulnerable Driver Blocklist by setting
VulnerableDriverBlocklistEnable to 0. This technique is used by threat actors,
such as the PoisonX RAT, to load vulnerable drivers (BYOVD) and evade or blind
EDR sensors.
Microsoft Vulnerable Driver Blocklist by setting
VulnerableDriverBlocklistEnable to 0. This technique is used by threat actors,
such as the PoisonX RAT, to load vulnerable drivers (BYOVD) and evade or blind
EDR sensors.
Detects the DLL sideloading primitive used by the ValleyRAT (SilverFox APT)
campaign documented by K7 Labs: a legitimate signed Windows binary executing
from C:\ProgramData\ (typically C:\ProgramData\client\) that has been weaponized
to sideload an attacker-controlled DLL. The K7 analysis documents GameBox.exe
(Tencent) as the carrier in this campaign, but ValleyRAT operators rotate
sideloading carriers across campaigns - AntiyAVL.exe, DXVZ.exe, DXOPT.exe,
VPNclient.exe, and various Chinese-language application binaries have all been
observed as carriers. The stable detection target is the technique: any
binary executing from ProgramData OR utility.dll being loaded from ProgramData.
campaign documented by K7 Labs: a legitimate signed Windows binary executing
from C:\ProgramData\ (typically C:\ProgramData\client\) that has been weaponized
to sideload an attacker-controlled DLL. The K7 analysis documents GameBox.exe
(Tencent) as the carrier in this campaign, but ValleyRAT operators rotate
sideloading carriers across campaigns - AntiyAVL.exe, DXVZ.exe, DXOPT.exe,
VPNclient.exe, and various Chinese-language application binaries have all been
observed as carriers. The stable detection target is the technique: any
binary executing from ProgramData OR utility.dll being loaded from ProgramData.
Detects a temporal pattern characteristic of CVE-2026-42897 XSS exploitation: an OWA user reads a message (via Bind, OpenMessage, or similar EWS/OWA endpoints), and within 60 seconds, the same session issues a POST request to create or modify an inbox rule. This rapid succession from the same session cookie indicates programmatic action (XSS-driven JavaScript) rather than human-driven workflow. The rule correlates events by client IP and username within a 60-second window.
Detects the use of launchctl submit to establish persistence on macOS.
Unlike the more common LaunchAgent/LaunchDaemon plist approach, launchctl
submit registers a job directly via the command line without creating a
plist file on disk, making it harder to discover through filesystem
sweeps. This technique is used by JINX-0164 (Wiz CIRT) to persist
AUDIOFIX and MINIRAT payloads with job labels like chrome.job and
coreaudio.job, but the technique itself is rare in legitimate software.
The rule catches any launchctl submit invocation and flags known
JINX-0164 job labels for high-confidence triage.
Unlike the more common LaunchAgent/LaunchDaemon plist approach, launchctl
submit registers a job directly via the command line without creating a
plist file on disk, making it harder to discover through filesystem
sweeps. This technique is used by JINX-0164 (Wiz CIRT) to persist
AUDIOFIX and MINIRAT payloads with job labels like chrome.job and
coreaudio.job, but the technique itself is rare in legitimate software.
The rule catches any launchctl submit invocation and flags known
JINX-0164 job labels for high-confidence triage.
Detects the execution of scripts (.vbs, .js, .wsf, etc.) proxied through explorer.exe or rundll32.exe (via shell32.dll).
Threat actors embed these commands in .LNK files to bypass direct cscript/wscript detections and break process tree lineage. Because the user executes the LNK from the GUI, the desktop explorer.exe acts as the parent, mimicking normal user activity.
Threat actors embed these commands in .LNK files to bypass direct cscript/wscript detections and break process tree lineage. Because the user executes the LNK from the GUI, the desktop explorer.exe acts as the parent, mimicking normal user activity.
Detects appcmd.exe installing an IIS native module from a user-writable or non-standard path, a persistence technique used by the BadIIS lwxat ecosystem and earlier BadIIS variants. The detection broadens beyond specific module names to catch any module installation with the structural characteristics of the malware family: appcmd.exe registering native modules from non-System32 paths, with both 32-bit and 64-bit variants, from cmd.exe or service host parents.
Detects the exploitation primitive of CVE-2026-3102 at the post-injection execution layer. The exploit succeeds when exiftool constructs a /usr/bin/setfile command line containing attacker-injected shell metacharacters (single quotes for command injection, backticks or $() for command substitution, semicolons for command chaining). Detecting setfile invocations spawned by exiftool with these characters in arguments is the smoking-gun signal. Even future variants of this vulnerability class (or related n-day exploits in the same family) would produce this same parent/child + metacharacter pattern.
Detects modifications to /home/vmanage-admin/.ssh/authorized_keys on Cisco SD-WAN controllers (vSmart, vManage, vBond) by any process. This file is a post-exploitation persistence target documented by Resecurity and Rapid7 for CVE-2026-20182. Legitimate modifications to this file are extremely rare in production SD-WAN deployments, as the vmanage-admin account is an internal service account and its authorized_keys file is provisioned during initial deployment and rarely touched afterward. Any write event is worth immediate investigation.
Detects registry modifications setting ConsentPromptBehaviorAdmin to 0, which weakens UAC protections by elevating without prompting. This behavior was observed in the TAX#TRIDENT campaign where a script disguised as a PNG altered UAC policies prior to silently installing a ManageEngine agent.
Page 10 of 92