Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,374 downloads4,081 copies490 likes318,459 views
919 detections
Filters
Last updated
All Time
Detection languages
328
314
163
59
21
Categories
261
235
219
212
173
Platforms
417
384
97
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
299
272
245
191
185
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects PowerShell making DNS requests for domains associated with less-reputable/uncommon TLDs. This behavior is not typical for legitimate administrative scripts and can indicate an attempt to download a payload from a malicious source.
Detects the creation of DLL files named with a GUID pattern in common staging directories. This technique was observed being used by the threat actor UKC-1230 to drop surrogate COM DLLs for persistence.
Detects the execution of the Mltab adware installer DLL, "OfficeTeam.Installer.dll", via rundll32.exe. This activity is part of a supply chain attack involving the Office Assistant software.
Detects instances where a ScreenConnect client or installer process is spawned by a web browser or email client. This behavior is indicative of a social engineering attack where a user is tricked into downloading and executing a rogue Remote Monitoring and Management (RMM) tool.
Detects the termination of Discord processes or a restart using Update.exe with the '--processStart' argument. This behavior is characteristic of the VVS Stealer, which uses this technique to inject malicious JavaScript for session hijacking.
Detects malicious browser extensions associated with the DarkSpectre 'Zoom Stealer' campaign by identifying known malicious extension IDs. The campaign uses these extensions for corporate espionage by stealing meeting intelligence from various video conferencing platforms.
Detects an attempt to disable .NET deserialization safeguards by modifying the 'disableActivitySurrogateSelectorTypeCheck' field. This technique was observed in an APT36 campaign where it was used to prepare the environment for the in-memory execution of a malicious DLL via unsafe deserialization.
Detects the tampering of the Microsoft Defender file system mini-filter driver's 'Altitude' registry value. The HoneyMyte APT's rootkit sets this value to '0' to prevent the driver from loading, effectively impairing system defenses.
Detects command injection attempts in HTTP POST requests targeting IoT device web interfaces, a technique used by the RondoDoX botnet to compromise vulnerable devices.
Detects the creation or modification of registry values used by the Valley RAT malware to store its configuration and modular plugins. Silver Fox operators use this mechanism for persistence and to dynamically update C2 infrastructure.
Page 29 of 92