Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,374 downloads4,081 copies490 likes318,459 views
919 detections
Filters
Last updated
All Time
Detection languages
328
314
163
59
21
Categories
261
235
219
212
173
Platforms
417
384
97
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
299
272
245
191
185
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
This rule detects patterns indicative of an Evilginx-style Adversary-in-the-Middle (AiTM) phishing attack. It specifically looks for HTTP requests to hostnames ending in suspicious top-level domains (TLDs) such as .click, .online, .cloud, or .shop, combined with specific URI paths like /wlc/, /load/, or /success/. These patterns are commonly used by AiTM redirectors to capture credentials and session tokens.
Detects HTTP POST requests containing WDDX XML payloads that attempt to exploit a deserialization vulnerability in Adobe ColdFusion (CVE-2023-26359). The attack leverages a JNDI injection with the 'com.sun.rowset.JdbcRowSetImpl' gadget chain.
Detects the installation of malicious npm packages associated with the Shai-Hulud 2.0 supply chain attack campaign.
Detects suspicious email inbox rule creation indicative of account compromise. Focuses on rules with randomly-generated names or rules that move emails to low-visibility folders combined with hiding actions (mark as read, delete, stop processing).
Detects the execution of a batch file from a common user directory (e.g., Downloads, Desktop) that immediately launches an executable file. This pattern was observed in a Webrat malware campaign where a `start_exp.bat` file was used to launch the primary malicious payload, `rasmanesc.exe`, tricking users into running it after extracting a fake exploit archive.
Detects the DLL sideloading technique used by the Evasive Panda APT group, where the legitimate and signed 'evteng.exe' executable is used to load the malicious 'libpython2.4.dll'.
Detects the use of attrib.exe to set system (+s) and hidden (+h) attributes on an executable file in a suspicious folder. This technique was observed being used by threat actors to hide payloads like SparkRAT.
Detects the loading of a vulnerable version of WindowsCodecs.dll (related to CVE-2025-50165) by non-standard applications. This could indicate an attempt to exploit the vulnerability in a custom or unexpected application context.
Detects the DriverFixer0428 macOS credential stealer, attributed to the North Korean 'Contagious Interview' campaign. This rule identifies the malware based on unique internal strings, network IOCs related to Dropbox exfiltration, and social engineering text.
Detects the creation of a Windows service named "NSecRTS" with the display name "Windows Real-time Protection Service" and an executable path in a suspicious "NSEC" folder. This behavior is associated with a China-linked RAT observed in an Indian Income Tax-themed phishing campaign.
Page 30 of 92