Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,374 downloads4,081 copies490 likes318,460 views
919 detections
Filters
Last updated
All Time
Detection languages
328
314
163
59
21
Categories
261
235
219
212
173
Platforms
417
384
97
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
299
272
245
191
185
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects the creation of a project-local OpenAI Codex configuration file (`.codex/config.toml`) followed by the execution of the `codex` CLI from the same directory. This pattern is indicative of an attempt to exploit CVE-2025-61260, a command injection vulnerability that allows for arbitrary code execution.
This rule detects HTTP GET requests containing specific URL patterns associated with Calisto phishing campaigns. The patterns include '/vendor/plugx/', '/wp-content/plugins/(bungs|areada|leykos)/', '/prueba/phantomrise/', or '/plugins/unite/', combined with the 'utm_refferer=' parameter in the URI. This indicates an attempt to redirect users to malicious content, likely as part of a phishing attack.
Detects the DUPERUNNER implant injecting shellcode into common legitimate Windows processes like explorer.exe, notepad.exe, or msedge.exe. This behavior is associated with the UNG0902 threat actor as part of the Operation DupeHike campaign.
Detects emails containing URLs with patterns characteristic of the Tycoon 2FA phishing kit. These URLs often contain a base64-encoded email address in the path, preceded by a special character.
Detects a network connection to an external SMB or WebDAV server immediately following the launch of a .url file. This behavior is associated with CVE-2024-43451, where threat actors use malicious .url files to leak NTLM hashes.
Detects the execution of mshta.exe with a URL containing a hex-encoded second octet in an IP address. This is a specific pattern observed in the initial access stage of the ClickFix malware campaign.
Detects the RomCom loader 'msedge.dll' being loaded from a location outside of the legitimate Microsoft Edge installation directory. This is a known TTP for the RomCom threat group to load their Mythic Agent, often as a result of COM hijacking.
Detects the creation of files with double extensions (e.g., .pdf.rar, .txt.exe), a technique used by the Water Gamayun APT group to disguise malicious payloads.
Detects HTTP requests attempting to exploit several IoT device vulnerabilities leveraged by the ShadowV2 botnet to spread. This rule looks for specific URI paths and command injection payloads associated with known CVEs.
Detects the creation of a Windows service with a suspicious name or an executable path in an unusual location, a technique used by APT41 for persistence.
Page 36 of 92