Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,374 downloads4,081 copies490 likes318,455 views
919 detections
Filters
Last updated
All Time
Detection languages
328
314
163
59
21
Categories
261
235
219
212
173
Platforms
417
384
97
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
299
272
245
191
185
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects DNS requests directed to the cloudapi[.]stream domain, which is associated with a widespread malicious Chrome extension campaign involving over 100 extensions. Monitoring for this specific domain allows defenders to identify compromised hosts regardless of the specific extension ID.
Detects HTTP requests containing the VS/PL/AN parameter combination used by JanelaRAT for C2 beaconing. The beacon reports malware version (VS), profile level (PL), and presence of banking security software (AN). JanelaRAT targets Latin American financial institutions (Brazil, Mexico). Note: C2 uses port 443 WITHOUT TLS encryption.
Detects non-Defender processes accessing or modifying the Defender signature definition file (mpasbase.vdm).
This behavior is indicative of the BlueHammer zero-day LPE, which leverages a batch oplock on this file to freeze Windows Defender mid-read, subsequently executing path confusion to force Defender to read the SAM hive as SYSTEM.
This behavior is indicative of the BlueHammer zero-day LPE, which leverages a batch oplock on this file to freeze Windows Defender mid-read, subsequently executing path confusion to force Defender to read the SAM hive as SYSTEM.
etects the full TeamPCP lateral movement pattern: listing secrets across namespaces followed by privileged alpine pod creation in kube-system. Correlation rule.
Detects attempts to manually remove the Apple quarantine extended
attribute using the xattr utility. This technique is often used by malware,
such as the notnullOSX stealer, to bypass macOS Gatekeeper protections on
downloaded payloads.
attribute using the xattr utility. This technique is often used by malware,
such as the notnullOSX stealer, to bypass macOS Gatekeeper protections on
downloaded payloads.
Detects attempts to read raw disk data using mknod or dd, a technique observed in malicious npm packages to bypass permissions and extract secrets.
Detects instances where PowerShell spawns the fontdrvhost.exe process. This parent-child relationship is highly anomalous and is indicative of process injection, as seen in the final stage of the ClipBanker malware execution chain.
Detects the creation or modification of Exchange Online inbox rules, transport rules, or mailbox settings where the rule name consists exclusively of special characters. This pattern can be indicative of malicious activity, such as an attacker attempting to hide a forwarding rule or other automated action by using an obscure name.
Detects systemctl commands enabling or starting a service named 'sysupdate', which Canis C2 uses to masquerade as a legitimate system update process and maintain persistence on Linux systems. The service restarts every 30 seconds.
This rule detects the execution of PowerShell commands that utilize .NET's System.Drawing.Bitmap class and the .GetPixel method. This combination is indicative of steganography techniques being used to extract hidden data, often malicious payloads, from image files. This specific pattern has been associated with APT29.
Page 15 of 92