Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,374 downloads4,081 copies490 likes318,461 views
919 detections
Filters
Last updated
All Time
Detection languages
328
314
163
59
21
Categories
261
235
219
212
173
Platforms
417
384
97
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
299
272
245
191
185
CVEs
6
4
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects the Kimsuky TTP of using legitimate cloud services like GitHub and Google Drive to download and subsequently execute malicious payloads, often using interpreters like mshta.exe or rundll32.exe.
Detects the execution of a malicious JAR file, a technique used by the Bloody Wolf APT group to download and execute NetSupport RAT components.
Detects a potential BADAUDIO DLL Sideloading persistence attempt, a technique used by APT24. The rule looks for the creation of a DLL, an executable, and a script/shortcut file (VBS, BAT, LNK) in a common user directory within a short time frame.
Detects a potential ToddyCat APT technique where a single source remotely accesses sensitive browser or DPAPI credential files on multiple hosts via SMB. This behavior is consistent with the group's TomBerBil PowerShell script used for widespread credential harvesting.
Detects the installation of the Velociraptor agent as a Windows service, a technique used by threat actors for persistence and command and control (C2).
Detects the Tsundere botnet infection chain where msiexec.exe launches a hidden, encoded PowerShell process, which in turn executes a Node.js spawner script.
Detects the execution of a Python interpreter with suspicious characteristics, such as running from a temporary location or using command-line arguments associated with obfuscation and in-memory execution. This behavior is consistent with Python-based stealers like Xillen Stealer.
Detects a PowerShell process launched by a JavaScript script host (wscript.exe or cscript.exe) that contains command-line arguments indicative of downloading, decoding, and reflectively loading a payload, a technique used by Phantom Stealer.
Detects S3 object encryption using either customer-provided keys (SSE-C) or externally managed KMS keys (BYOK/XKS). These methods are leveraged by S3 ransomware variants to encrypt data with keys that are not controlled by the victim or AWS, making recovery difficult or impossible without paying a ransom.
This rule detects command and control (C2) communication associated with the Lazarus Group's ScoringMathTea Remote Access Trojan (RAT). It specifically looks for HTTP traffic where the User-Agent header matches a known string used by this malware: 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.42'. This User-Agent string attempts to masquerade as a legitimate Microsoft Edge browser.
Page 37 of 92