Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,374 downloads4,081 copies490 likes318,459 views
919 detections
Filters
Last updated
All Time
Detection languages
328
314
163
59
21
Categories
261
235
219
212
173
Platforms
417
384
97
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
299
272
245
191
185
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects the creation and execution of anonymous memory-backed files using `memfd_create`. This technique is used by malware like VoidLink to execute modular plugins or payloads directly in memory, bypassing disk-based detection mechanisms.
Detects the DLL sideloading of the Kazuar v3 loader (hpbprndiLOC.dll) by a legitimate Hewlett-Packard printer driver installer (hpbprndi.exe). This technique is used by Turla to initiate its infection chain.
Detects the SHADOW#REACTOR process execution chain of wscript.exe spawning powershell.exe, which in turn spawns MSBuild.exe.
Detects PowerShell commands that utilize string normalization obfuscation techniques before Base64 decoding. This rule identifies a generic pattern where one or two placeholder characters are replaced with a literal character, a technique used by malware like SHADOW#REACTOR to bypass static string analysis of the encoded payload.
Detects when a Python process spawns a shell or a network utility. This behavior can be indicative of Remote Code Execution (RCE) vulnerabilities being exploited in AI/ML libraries (e.g., CVE-2025-23304, CVE-2026-22584) that allow attackers to execute arbitrary code when a malicious model file is loaded.
Detects MuddyWater Rust-based implants containing unstripped build artifacts, specifically the username 'Jacob' and other development environment paths.
Detects a sequence of events associated with the Astaroth banking trojan, where a script downloads a file from a raw GitHub URL, followed by the execution of an AutoIT interpreter. Astaroth is known to use GitHub to host configuration files disguised as images (steganography).
Detects when the Landlock Linux Security Module (LSM) denies an access request from a sandboxed application. This indicates that a process is attempting to perform an action that violates its predefined security policy, which can be a sign of misconfiguration or malicious activity such as exploitation.
Detects the injection of a malicious iframe with attributes that impersonate the legitimate Stripe payment interface. This technique is used by Magecart actors to steal credit card data by replacing the real payment form with a clone.
Detects outbound network traffic with a User-Agent header indicating the use of the Rust 'reqwest' HTTP client library. This User-Agent is used by the RustyWater implant, associated with the MuddyWater APT group, for command and control (C2) communications.
Page 27 of 92