Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,374 downloads4,081 copies490 likes318,455 views
919 detections
Filters
Last updated
All Time
Detection languages
328
314
163
59
21
Categories
261
235
219
212
173
Platforms
417
384
97
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
299
272
245
191
185
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Suspicious IIS Worker Child Process
Cortex XDR
Detects the IIS worker process (w3wp.exe) spawning anomalous or administrative child processes (e.g., rundll32.exe, csvde.exe, nltest.exe), indicative of post-exploitation web shell activity associated with SHADOW-EARTH-053.
Regasm Executing Text File Payload
Cortex XDR
Identifies regasm.exe executing a payload disguised as a .txt file. This technique is used by the CloudZ RAT dropper to execute its disguised .NET loader via a scheduled task while evading standard executable-based alerting. The rule specifically looks for 'regasm.exe' in the process image name and '.txt' in the command line, with additional specificity for '/nologo', 'update.txt', or 'msupdate.txt' to narrow down to known campaign indicators.
This rule detects the creation of files matching the exfiltration pattern used by the Mini Shai-Hulud malware. Specifically, it looks for files named 'results-<timestamp>-<counter>.json' within a 'results' directory, accounting for both Windows and Unix path separators. This pattern is indicative of data staging or exfiltration activities by the malware.
Detects high-fidelity static artifacts from VECT 2.0 across Windows, Linux, and ESXi variants. This includes known SHA-256 hashes of the ransomware executables, the '.vect' encrypted file extension, the '!!!READ_ME!!!.txt' ransom note, the 'dvm3_wall.bmp' wallpaper, the 'vector_notice.sh' shell hook, and the embedded Tor C2 hostname. These indicators are unique to VECT ransomware and have no legitimate use.
Detects PowerShell commands reading their own batch file contents via the %~f0 self-reference combined with .NET ReadAllText, the technique Deep#Door uses to extract its embedded Python payload from install_obf.bat without external network retrieval. The combination of these specific patterns has near-zero legitimate use.
Detects PowerShell command lines utilizing Invoke-WebRequest (or aliases) with a spoofed "ZoomSDK" User-Agent for payload delivery. This behavior is associated with BlueNoroff ClickFix campaigns targeting the Web3 sector.
Detects a Python process attempting to access the memory of another process via the /proc filesystem. This behavior was observed in the Shai-Hulud SAP CAP supply chain attack, where a Python script dumped the Runner.Worker process memory to extract short-lived, high-value tokens passed between CI workflow steps.
Detects modifications to the OpenClaw agent's SOUL.md file, which dictates the core behavior and instructions of the agent. Attackers exploit this by tampering with the file to persistently alter the agent's actions across all future sessions without needing traditional code execution, as seen in attacks against NVIDIA NemoClaw sandboxes.
Detects the execution of a Python interpreter (pythonw.exe) running the 'appclient' module from within the C:\ProgramData\Tailscale directory. This technique is used by the Silver Fox APT group to deploy the ABCDoor backdoor while masquerading as legitimate VPN software to evade detection.
Detects pip or pip3 installation commands targeting the specific compromised version of the elementary-data PyPI package. Installation of v0.23.3 indicates exposure to the supply chain compromise regardless of whether the marker file was subsequently observed. Also catches generic 'pip install elementary-data' without a version pin, which during the active window (2026-04-24 22:20 UTC to 2026-04-25 ~11:51 UTC) would have pulled the malicious version.
Page 13 of 92