Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,374 downloads4,081 copies490 likes318,461 views
919 detections
Filters
Last updated
All Time
Detection languages
328
314
163
59
21
Categories
261
235
219
212
173
Platforms
417
384
97
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
299
272
245
191
185
CVEs
6
4
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
This rule detects inbound HTTP requests containing the User-Agent string 'Salesforce-Multi-Org-Fetcher/1.0'. This specific User-Agent has been associated with data theft from Salesforce instances, as detailed in a Google Cloud blog post. The detection aims to identify potential malicious activity targeting web server applications, specifically Salesforce environments, where an attacker might be attempting to exfiltrate data.
ET MOBILE_MALWARE Klopatra CnC Domain in DNS Lookup (guncel-tv-player-lnat .]com)
This rule detects inbound HTTP requests containing the User-Agent string 'Salesforce-CLI/1.0'. This activity is considered suspicious as it may indicate reconnaissance or data theft attempts targeting Salesforce instances, potentially leveraging compromised credentials or systems. The presence of this specific User-Agent inbound to a network could be an indicator of malicious activity, as Salesforce CLI is typically used by developers and administrators for managing Salesforce organizations and is not expected to be seen in inbound traffic from external networks to internal systems.
Detects attempts to exploit the Triofox authentication bypass vulnerability (CVE-2025-12480) by sending a request with a 'localhost' Host header from an external IP address to access administrative pages. This allows an attacker to create a new administrative account.
ET MOBILE_MALWARE Observed Klopatra Domain (guncel-tv-player-lnat .]com) in TLS SNI
ET MOBILE_MALWARE Observed Klopatra Domain (adsservice2 .org) in TLS SNI
Detects network traffic to Large Language Model (LLM) providers that have not implemented mitigations for the Whisper Leak side-channel attack. Communication with these providers is more susceptible to topic inference attacks.
This rule detects inbound network traffic attempting to exploit a path traversal vulnerability (CVE-2025-8088) related to RAR files and Alternate Data Streams (ADS). The detection logic specifically looks for a pattern indicative of path traversal attempts within the RAR file structure over raw TCP connections, excluding HTTP traffic. This exploit could allow an attacker to write files to arbitrary locations on a compromised system.
SQL Database Version Discovery
Suricata
This rule detects attempts to discover the version of a SQL database, often a precursor to SQL injection attacks or other reconnaissance activities. It specifically looks for SQL queries containing keywords like 'select' and 'version' in various common formats used to retrieve database version information.
Detects the ClickOnce service (dfsvc.exe) DLL sideloading an unsigned DLL from the ClickOnce application cache directory. This behavior is indicative of a malicious ClickOnce deployment, a technique used for initial access and code execution as seen in 'OneClik' and 'SesameOp' campaigns.
Page 41 of 92