Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,374 downloads4,081 copies490 likes318,460 views
919 detections
Filters
Last updated
All Time
Detection languages
328
314
163
59
21
Categories
261
235
219
212
173
Platforms
417
384
97
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
299
272
245
191
185
CVEs
6
4
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects Microsoft Excel spawning an executable in a typical malware staging directory directory. This behavior is a strong indicator of a malicious XLL loader used by the Paper Werewolf (GOFFEE) group to drop the EchoGather backdoor.
Detects the execution of Node.js with the '-e' flag, which evaluates a string as JavaScript. This technique is used by the EtherRAT implant for fileless execution, particularly for privilege escalation attempts.
Detects the disabling of the VMware ESXi firewall using 'esxcli', a technique used by the RansomHouse 'MrAgent' tool as a defense evasion tactic before encryption.
Detects a specific COM hijacking technique used by the ForumTroll APT group for persistence. This rule identifies registry modifications to the CLSID {1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}, which the group has reused across campaigns.
Detects the use of Visual Studio Code (VSCode) tunnels for command and control (C2) or persistence. This technique, observed in use by threat actors like MUSTANG PANDA, leverages legitimate VSCode functionality to bypass network defenses.
Detects the deletion of the ':Zone.Identifier' Alternate Data Stream (ADS) from a file. This is a technique used by malware like Phorpiex to remove the Mark-of-the-Web and bypass security warnings on downloaded files.
Detects the setup for a Time-of-Check-to-Time-of-Use (TOCTOU) attack exploiting CVE-2025-64669 in Windows Admin Center. An attacker uses PowerShell with Register-WmiEvent to monitor for the WAC updater process, intending to perform a DLL hijack for privilege escalation.
Detects a browser hijacking technique where a WMI-driven script terminates a running browser process (Chrome or Edge) and immediately restarts it with malicious command-line arguments to load an unauthorized extension.
Detects modifications to the Windows Registry that disable critical security features, specifically related to Restricted Admin Mode, UAC remote token filtering, and DSRM logon behavior. Ink Dragon uses these modifications to facilitate lateral movement and maintain domain dominance.
Detects anomalous Okta sign-on policy evaluations originating from Cloudflare, which could indicate an Adversary-in-the-Middle (AiTM) phishing attempt. The associated campaign uses Cloudflare to host its phishing infrastructure.
Page 32 of 92