Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,374 downloads4,081 copies490 likes318,457 views
919 detections
Filters
Last updated
All Time
Detection languages
328
314
163
59
21
Categories
261
235
219
212
173
Platforms
417
384
97
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
299
272
245
191
185
CVEs
6
4
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects a specific data exfiltration pattern observed in the Notepad++ supply chain attack. An attacker uses curl.exe to upload a file containing reconnaissance data to the temp.sh file sharing service. Subsequently, a beacon is sent to the C2 where the User-Agent string of the HTTP request contains the temp.sh URL for the exfiltrated data.
Detects HTTP POST requests to n8n webhook endpoints containing patterns associated with CVE-2026-25049, a type confusion vulnerability leading to Remote Code Execution. The detection looks for specific JavaScript destructuring or property access patterns used to bypass sanitization.
Detects the 'codesign' utility being used to extract code-signing requirements from trusted macOS system binaries. This is a key step used by malware to forge TCC permissions and inherit the privileges of trusted applications. The rule specifically looks for 'codesign' execution with '-d' and '--requirements' flags targeting common trusted binaries, initiated by scripting interpreters.
Detects Okta MFA device enrollment or life cycle changes that occur shortly after a successful authentication or password reset for the same user. This pattern is a strong indicator of a post-vishing account takeover, as seen in ShinyHunters campaigns.
Detects Bash /dev/tcp with HTTP request construction - high fidelity detection for payload download via raw sockets
Detects when a user authorizes the 'ToogleBox Recall' Google Workspace add-on. This tool has been observed being used by threat actors like UNC6661 (associated with ShinyHunters) to automate the deletion of MFA enrollment notifications, hiding unauthorized device registrations.
Detects DKnife attempting to discover network information by sending a POST request with a specific password hash to a router management interface. This activity is associated with the DKnife framework, a China-nexus gateway-monitoring tool.
Detects a command line pattern where `curl` is used to download a payload, which is then piped to `base64` for decoding and `gunzip` for decompression. This technique is commonly used by macOS infostealers like DigitStealer and MacSync to execute malware in memory without writing it to disk.
Detects attempts to exploit a vulnerability in Google Looker (CVE-2025-12743) by using error-based SQL injection within LookML dimension definitions. Attackers can use this to exfiltrate the internal Looker database.
Detects the execution of a command shell by the Java Runtime to run a batch file from a typical malware staging directory. This behavior is a core TTP of the Stan Ghouls group, used to execute their malicious Java-based loaders which in turn drop and run the NetSupport RAT.
Page 22 of 92