Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,374 downloads4,081 copies490 likes318,457 views
919 detections
Filters
Last updated
All Time
Detection languages
328
314
163
59
21
Categories
261
235
219
212
173
Platforms
417
384
97
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
299
272
245
191
185
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects the use of the Microsoft Device Console (devcon.exe) to disable VMware Virtual Machine Communication Interface (VMCI) devices. This is a preparatory step observed in the 'MAESTRO' toolkit to gain exclusive hardware access before loading a malicious driver for a VM escape exploit.
Detects pkr_mtsi packer samples based on their characteristic use of junk GDI API calls for obfuscation. The rule looks for PE files that import an excessive number of GDI32.dll functions and contain repeated calls to CreateSolidBrush with random color values.
Detects specific User-Agent strings associated with the DDoSia malware, which is used by the NoName057(16) hacktivist group for DDoS attacks. The rule looks for two distinct User-Agent patterns in HTTP traffic.
Detects HTTP POST requests to n8n '/form/*' endpoints where the Content-Type header is 'application/json'. This indicates an attempt to exploit the Content-Type confusion vulnerability (CVE-2026-21858) to achieve arbitrary file read and subsequent remote code execution.
Detects a URL containing common redirection or proxy parameters where the value appears to be a ROT13 obfuscated URL, indicated by the presence of 'uggcf' ('https') and common ROT13'd TLDs. This is an evolution of a TTP observed in Kimsuky campaigns.
Detects phishing emails containing QR codes rendered using HTML tables. This technique is used to evade image-based scanning and OCR security controls by representing the QR code as a grid of small, colored table cells (<td>) instead of a traditional image file.
Detects the creation of a browser process in headless mode and in a suspended state. This technique is used by infostealers like AuraStealer to inject code into the browser process to bypass Application-Bound Encryption (ABE) and steal credentials.
Detects the ToddyCat APT group's technique of using PowerShell to connect to remote hosts via SMB admin shares (C$) and steal web browser credentials. This is associated with a variant of the TomBerBil tool and is particularly significant when observed originating from a domain controller.
Detects processes that masquerade as the 'init' process, a technique used by the GoBruteforcer malware. The rule identifies processes named 'init' while filtering out legitimate system init processes based on their process ID, parent process ID, and executable path.
Detects a specific command used by the Bulbature malware (associated with UAT-7290) to obtain the local network interface's name. This is part of its system reconnaissance routine.
Page 28 of 92