Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,374 downloads4,081 copies490 likes318,457 views
919 detections
Filters
Last updated
All Time
Detection languages
328
314
163
59
21
Categories
261
235
219
212
173
Platforms
417
384
97
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
299
272
245
191
185
CVEs
6
4
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects the SmarterMail service process ('MailService.exe') spawning command-line interpreters to execute reconnaissance commands. This behavior is highly indicative of remote code execution following the exploitation of vulnerabilities like CVE-2026-23760.
Detects the legitimate Adobe binary 'ADNotificationManager.exe' loading 'urlmon.dll' from a non-system directory. This is a DLL Sideloading technique (T1574.002) used by a Vietnamese Stealer campaign for initial execution.
Detects attempts to exploit an authentication bypass vulnerability in the Inetutils Telnet daemon. Attackers inject the '-f' flag into the 'USER' environment variable during Telnet negotiation to gain unauthorized shell access.
Detects the execution of a piped command chain typical of 'ClickFix' lures used by the MacSync infostealer. The malware tricks users into pasting a command into the terminal which uses curl to download a payload, decodes it with base64, and pipes it directly into a shell (zsh, sh) or osascript for execution, bypassing macOS security controls like Gatekeeper.
Detects the execution of the Windows utility 'grpconv.exe' when it is spawned by a parent process located in a temporary or otherwise uncommon directory. This is an unusual parent-child relationship and is indicative of techniques like process hollowing used by malware such as the Evelyn Stealer's second-stage injector.
Detects the use of a command injection vulnerability in the legitimate Windows script 'SyncAppvPublishingServer.vbs' to execute arbitrary code. As seen in the ClearFake campaign, attackers can append a semicolon to the command-line arguments to execute subsequent malicious PowerShell commands.
Detects a Python process executing a binary from an in-memory file descriptor via the /proc filesystem. This technique was observed in the malicious 'sympy-dev' PyPI package, which used it to execute a cryptominer from memory, bypassing some file-based detections.
Detects attempts to exploit the SmarterMail authentication bypass vulnerability (WT-2026-0001) by sending a POST request to the /api/v1/auth/force-reset-password endpoint with 'IsSysAdmin' set to 'true'.
Detects the creation of a macOS Launch Agent by a suspicious process or with a name matching patterns used by the BlueNoroff group. BlueNoroff uses Launch Agents for persistence on compromised macOS systems.
Detects processes, other than legitimate web browsers or the official Telegram client, making DNS queries for the Telegram Bot API. This behavior is indicative of malware using Telegram for command-and-control (C2) or data exfiltration, as seen in a campaign leveraging Amnesia RAT.
Page 25 of 92