Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,374 downloads4,081 copies490 likes318,454 views
919 detections
Filters
Last updated
All Time
Detection languages
328
314
163
59
21
Categories
261
235
219
212
173
Platforms
417
384
97
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
299
272
245
191
185
CVEs
6
4
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects `git rebase` commands containing the `--exec=` flag when spawned by a Gogs or Gitea server process. This activity is indicative of the exploitation of an argument injection vulnerability (CVE-2022-46153) in Gogs/Gitea, which allows an authenticated user to achieve Remote Code Execution (RCE) by creating a pull request with a specially crafted branch name. The rule specifically looks for `git` or `git.exe` processes executing `rebase` with `--exec=` and originating from `gogs`, `gitea`, or common shell processes that might be spawned by them.
Systeminfo.exe Making Network Connection
Cortex XDR
Detects network connections originating from the systeminfo.exe process. This activity is suspicious because systeminfo.exe is a legitimate system enumeration tool not typically expected to initiate outbound network connections. This behavior has been observed in malware campaigns, such as CountLoader, which injects a cryptocurrency clipper into systeminfo.exe to communicate with C2 servers and the Ethereum blockchain.
Detects the ClickFix paste-and-run initial-access primitive used by KongTuke and other groups. This involves `explorer.exe` spawning PowerShell with defense-evasion arguments (`-NoProfile`, `-ExecutionPolicy Bypass`, `-WindowStyle Hidden`) and a downloader chain targeting cloud file-sharing services. The combination of `explorer.exe` parent (user typing into Run dialog), hidden execution flags, `Invoke-WebRequest`, and `Expand-Archive` in one command line is the defining fingerprint of the technique.
FDMTP C2 Registration Request
Cortex XDR
Detects network HTTP requests to the '/GetCluster' endpoint containing the 'DotNet-TcpDmtp' protocol parameter, a specific C2 registration pattern used by the updated FDMTP backdoor.
This rule detects potential exploitation of CVE-2026-4892 by correlating inbound DHCPv6 traffic (UDP/547) with a dnsmasq process crash (SIGSEGV/SIGABRT exit codes 132, 134, 135, 139) on the same host within a 60-second window. This vulnerability involves sending crafted DHCPv6 messages with oversized Client Identifier options to a dnsmasq server configured with --dhcp-script, leading to a denial of service.
Detects the registration of the PLURIBUS Cloud Files sync provider used by the CVE-2023-36036 (cldflt.sys heap overflow) privilege escalation exploit in the Rapid7-documented ModeloRAT incident. The exploit registers a fake sync provider with the specific GUID {904EE598-0511-4664-82A8-22C4A7501044} pointing to %TEMP%\cldflt\, then writes a placeholder file (Link.log) to trigger the vulnerable code path. The provider GUID, name, and registry path are all unique to this exploit variant — legitimate sync providers (OneDrive, Dropbox, Box) use vendor-specific GUIDs and never register under %TEMP%.
Detects dnsmasq or its DHCP helper child process terminating abnormally on Linux hosts due to signals like SIGSEGV, SIGABRT, SIGBUS, or SIGILL. This behavior is indicative of a crash, potentially caused by exploitation attempts of vulnerabilities such as CVE-2026-4892, a heap buffer overflow in dnsmasq's helper.c when processing oversized DHCPv6 Client Identifier (CLID) options. This rule fires post-impact, complementing network-side detections.
Detects the creation or modification of the 'FsTx' directory within 'System Volume Information' on any volume, which is a staging step required by the YellowKey BitLocker bypass (Windows 11, Server 2022/2025). The attacker copies the FsTx folder to either a USB stick's System Volume Information directory OR the target machine's EFI System Partition, then reboots into WinRE while holding CTRL to trigger a shell with unrestricted access to the BitLocker-protected volume. The FsTx folder name has no legitimate use; modifications to System Volume Information by non-system processes are inherently suspicious.
POW Proxy-over-Web Custom HTTP Headers
Cortex XDR
Detects HTTP traffic containing the custom POST headers used by the SHADOW-AETHER-064 'POW' (Proxy over Web) tool to encapsulate SOCKS5 traffic inside HTTP requests forwarded through JSP webshells. The full header set per Trend Micro's analysis is X-Act, X-Sid, X-Host, X-Port, and X-Status. The X-Act header carries one of five specific command values (CONNECT, SEND, RECV, DISCONNECT, PING) which provides an additional fidelity boost. The combination of two or more of these headers in a single HTTP transaction is exclusive to the POW tool.
Detects execution of Python with PySoxy SOCKS5 proxy arguments (-ssl, -remote_port, -remote_ip) alongside compiled bytecode (.pyc) execution. PySoxy is a 10-year-old open-source SOCKS5 proxy that ReliaQuest observed being deployed via ClickFix as a secondary encrypted access path alongside PowerShell-based C2. The specific combination of these three argument flags with .pyc execution is rare in legitimate use and represents the PySoxy invocation pattern verbatim.
Page 11 of 92