Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,374 downloads4,081 copies490 likes318,459 views
919 detections
Filters
Last updated
All Time
Detection languages
328
314
163
59
21
Categories
261
235
219
212
173
Platforms
417
384
97
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
299
272
245
191
185
CVEs
6
4
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects a specific DLL side-loading pattern used by APT37 in the 'Operation Artemis' campaign. A legitimate Sysinternals utility (e.g., 'mhelp.exe', 'vhelp.exe', 'Volumeid1.exe') is executed from a suspicious directory and loads a malicious 'version.dll' from the same path.
Detects the creation of systemd services used by the PCPcat malware for persistence on Linux systems.
Detects successful Microsoft 365 sign-ins using the OAuth 2.0 device code grant flow for applications with low prevalence. This technique is used by threat actors to gain unauthorized access to accounts, bypassing some MFA controls.
Detects the execution of the `iwpriv` utility by an unprivileged user targeting subcommands that are vulnerable to Local Privilege Escalation (LPE) in certain MediaTek Wi-Fi drivers. The exploitation of these vulnerabilities is demonstrated to be possible by unprivileged users, making the execution of kernel-level configuration tools like `iwpriv` by non-root users a highly suspicious activity.
Identifies JSON Web Tokens (JWTs) where the signing algorithm in the header ('alg') is set to 'none'. A server that incorrectly trusts this header may skip signature validation, allowing an attacker to create arbitrary tokens and bypass authentication controls.
Detects a successful SSO administrative login followed by a system configuration download from the same user and source IP address within 5 minutes. This sequence is a strong indicator of compromise related to CVE-2025-59718 and CVE-2025-59719.
Detects when legitimate .NET utilities, often abused for process hollowing, make outbound network connections. This is anomalous behavior and may indicate that the process has been injected with malicious code to bypass defenses.
Detects PNG files containing a steganographic marker ('===') used by the GhostPoster malware campaign to hide a JavaScript payload. This technique was observed in malicious Firefox browser extensions.
Detects the legitimate Windows utility MSBuild.exe initiating any outbound network connections. MSBuild.exe is a software build tool and should not typically make network connections outside of development environments. This behavior is highly indicative of process hollowing, where malware injects itself into the MSBuild process to evade defenses, as seen in recent BlindEagle campaigns.
Detects the creation or modification of the '/tmp/sslvpn.log' file, a known artifact of a new Linux variant of the Lazarus BADCALL backdoor.
Page 31 of 92