Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,374 downloads4,081 copies490 likes318,457 views
919 detections
Filters
Last updated
All Time
Detection languages
328
314
163
59
21
Categories
261
235
219
212
173
Platforms
417
384
97
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
299
272
245
191
185
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects the execution of a SimpleHelp RMM executable from a non-standard file path. This behavior is associated with threat actors establishing persistence after exploiting vulnerabilities like CVE-2026-1731 in BeyondTrust appliances.
Detects Chromium-based browsers (e.g., Microsoft Edge, Google Chrome) being launched with specific command-line arguments that attempt to hide the browser window (headless mode or positioning it off-screen).
This technique was observed in the "Operation MacroMaze" campaign, attributed to APT28, where it was used to silently execute scripts and exfiltrate data using legitimate services like webhook.site.
This technique was observed in the "Operation MacroMaze" campaign, attributed to APT28, where it was used to silently execute scripts and exfiltrate data using legitimate services like webhook.site.
Detects when a VM Run Command is executed successfully, followed by the VM's Managed Identity authenticating to Azure Resource Manager. This pattern may indicate an attacker using Run Command to steal MI tokens for lateral movement.
Detects access to VMware virtual disk files (.vmdk). This technique was
observed being used by the Muddled Libra (Scattered Spider) threat group,
where they would power down Domain Controllers, mount their disks to a rogue
VM, and steal the NTDS.dit and SYSTEM hives for offline credential extraction.
This method bypasses security monitoring that would typically occur on the
Domain Controller itself.
observed being used by the Muddled Libra (Scattered Spider) threat group,
where they would power down Domain Controllers, mount their disks to a rogue
VM, and steal the NTDS.dit and SYSTEM hives for offline credential extraction.
This method bypasses security monitoring that would typically occur on the
Domain Controller itself.
Detects the creation of a JavaScript file in unusual subdirectories of the Google Chrome user data or application support folders. This behavior was observed in the 'graphalgo' campaign by the Lazarus Group to stage second-stage payloads.
Detects a sequence of macOS system profiling and software update commands associated with the UNC1069 'ClickFix' social engineering ruse, often followed by a payload download via curl piped to a shell.
Detects a sequence of HTTP requests where the User-Agent shifts from 'WordPressAgent' to 'FingerPrint' within a short time window, a behavior associated with OysterLoader C2 registration and payload retrieval.
Detects the SolarWinds Web Help Desk service process (java.exe) launching shell or installer processes to download payloads from suspicious domains. This behavior is consistent with the exploitation of CVE-2025-26399 as reported by Huntress.
Detects the use of 'dscl . authonly' to validate user passwords, a technique
used by the SHub Stealer malware to verify credentials before exfiltration.
The malware typically executes this command from a shell or AppleScript
interpreter.
used by the SHub Stealer malware to verify credentials before exfiltration.
The malware typically executes this command from a shell or AppleScript
interpreter.
Detects attempts to deliver a Base64-encoded Java class to an Ivanti EPMM
server. This is characteristic of the "Sleeper Shell" campaign where attackers
plant a dormant in-memory backdoor. The rule looks for the Base64 string
'yv66vg', which corresponds to the 'CAFEBABE' Java magic bytes, in requests
targeting the known vulnerable path.
server. This is characteristic of the "Sleeper Shell" campaign where attackers
plant a dormant in-memory backdoor. The rule looks for the Base64 string
'yv66vg', which corresponds to the 'CAFEBABE' Java magic bytes, in requests
targeting the known vulnerable path.
Page 21 of 92