Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,374 downloads4,081 copies490 likes318,455 views
919 detections
Filters
Last updated
All Time
Detection languages
328
314
163
59
21
Categories
261
235
219
212
173
Platforms
417
384
97
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
299
272
245
191
185
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects cmd.exe executing a batch script disguised with a .txt extension, a persistence technique used by SERPENTINE#CLOUD. The campaign delivers VenomRAT, AsyncRAT, XWorm/Violet, PureHVNC, and Brute Ratel C4 via ClickFix lures and Cloudflare tunnels.
Masqueraded wt.exe - Branch A: Impostor Binary Named wt.exe Detects a process with image name wt.exe whose OriginalFileName does NOT match wt.exe — i.e., a renamed binary masquerading as Windows Terminal.
Branch B: Legitimate wt.exe from Non-Standard Path Detects execution of a binary with OriginalFileName=wt.exe running from outside the expected Windows Terminal directories (WindowsApps).
Branch B: Legitimate wt.exe from Non-Standard Path Detects execution of a binary with OriginalFileName=wt.exe running from outside the expected Windows Terminal directories (WindowsApps).
Detects PowerShell execution that interacts with GitHub API or raw content endpoints and includes a GitHub Personal Access Token (PAT) in the command line. This combination can indicate malicious activity such as data exfiltration, code deployment, or C2 communication, especially if originating from an unexpected host or user.
Detects the execution of a process named 'wt.exe' (Windows Terminal) from a non-standard directory, or deliberately renamed. This behavior is associated with the Axios npm supply chain attack, where the Windows RAT dropper copies 'powershell.exe' to '%PROGRAMDATA%\wt.exe' to masquerade its execution.
This rule detects attempts to exploit a vulnerability in ShareFile (CVE-2026-2699/CVE-2026-2701) by monitoring for HTTP GET requests to the `/ConfigService/api/StroageZoneConfig` URI path with a `h=` query parameter. This pattern is indicative of an attacker trying to leak API secrets.
Detects PowerShell queries against the root/SecurityCenter2 namespace to discover installed Antivirus products. This technique is often used by malware, such as EtherRAT's SYS_INFO module, to map defensive tooling and understand the security posture of a compromised system.
Detects the execution of `system_profiler` querying memory and hardware data types. Atomic Stealer (AMOS) utilizes these environmental awareness checks prior to execution to evade analysis by determining if it is running within a virtual machine environment.
Detects HTTP POST requests targeting the Langflow public flow build endpoint, which is vulnerable to unauthenticated Remote Code Execution (CVE-2026-33017).
Detects the specific OpenSSL command line arguments used by TeamPCP (Trivy compromise) to encrypt stolen credentials before exfiltration using a hybrid AES-256-CBC scheme. This rule looks for the 'openssl' executable being run with 'enc -aes-256-cbc' or 'enc -aes-256' and a passphrase specified via a file using '-pass file:'.
Detects authentication attempts utilizing a specific synthetic mobile user agent (iOS 18 paired with Safari Version/26.x) observed in the EvilTokens device code phishing campaign. Version 26 does not exist on iOS 18.
Page 16 of 92