Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,374 downloads4,081 copies490 likes318,457 views
919 detections
Filters
Last updated
All Time
Detection languages
328
314
163
59
21
Categories
261
235
219
212
173
Platforms
417
384
97
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
299
272
245
191
185
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects the execution of the .NET compiler utility 'Aspnet_compiler.exe' by a scripting engine like PowerShell or JScript/VBScript. This behavior is highly unusual and is a known technique used by malware like Agent Tesla to perform process hollowing, where the legitimate 'Aspnet_compiler.exe' process is hollowed out and injected with malicious code.
Detects the execution of "rundll32.exe" without any command-line arguments. This is highly unusual behavior, as "rundll32.exe" is intended to load and run functions from DLLs, which requires specifying a DLL path in the command line. This technique is used by malware like ValleyRAT (as part of the Winos4.0 framework) to inject modular plugins into memory.
Detects HTTP requests to vulnerable Ivanti EPMM endpoints containing URI patterns associated with active exploitation of CVE-2026-1281 and CVE-2026-1340. The rule looks for specific URI paths and the presence of a 'gPath' parameter, which is indicative of an exploitation attempt.
Detects the execution of a command pattern commonly associated with "ClickFix" social engineering attacks. This technique tricks users into pasting a command into their terminal, which typically uses 'echo' to pass a base64 encoded string to the 'base64' utility for decoding, and then pipes the output to a shell for execution. This method is used to bypass traditional OS-level protections like Gatekeeper and Notarization.
Detects behavioral indicators associated with a malware campaign distributing a credential and crypto-wallet stealer disguised as a Windows 11 update. Detection is based on TTPs rather than IOCs for longevity: suspicious directory creation, obfuscated PowerShell execution, and registry-based persistence.
Detects incoming emails from Atlassian Jira domains (atlassian.net) that contain suspicious link redirectors or known Traffic Distribution Systems (TDS) like Keitaro. This activity is associated with a campaign where threat actors abuse Jira's trusted domain to send spam and phishing emails.
Detects outgoing network connections using the User-Agent 'ArkanixStealer/1.0', which is hardcoded in the C++ variant of the Arkanix Stealer.
Detects the execution of iptables commands used for Single Packet Authorization (SPA), a technique observed being used by UNC6201. This rule identifies when iptables is configured to inspect traffic on port 443 for a specific hex string, which is a key component of the actor's C2 proxying tradecraft.
Detects the use of 'icacls.exe' to grant 'Full Control' permissions to 'Everyone' on directories used by JWrapper and the SimpleHelp RMM tool. This behavior was observed in campaigns where threat actors use JWrapper to package and deliver the SimpleHelp RAT, and this command ensures the malware has unrestricted access to its installation folders.
Detects the creation of files with a .sys extension in the C:\Windows\System32\drivers\ directory that are actually portable executables (DLLs/EXEs). This is a staging technique used by the REF4033 group to deploy the BADIIS malware.
Page 20 of 92