Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,374 downloads4,081 copies490 likes318,454 views
919 detections
Filters
Last updated
All Time
Detection languages
328
314
163
59
21
Categories
261
235
219
212
173
Platforms
417
384
97
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
299
272
245
191
185
CVEs
6
4
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects the Unicode RIGHT-TO-LEFT OVERRIDE character (U+202E) in process
command lines. Adversaries insert RTLO to reverse the rendering of a filename
so an executable payload displays as a benign document type.
command lines. Adversaries insert RTLO to reverse the rendering of a filename
so an executable payload displays as a benign document type.
This rule detects a suspicious pattern on Linux systems where a process creates a file in the /tmp directory with a name consisting of a long hexadecimal string (indicative of a hash, often used by Rust-based loaders for Sliver or similar implants), followed immediately by the execution of that same file by the initiating process.
Detects the loading of 'tempdir.dll', a module identified as implementing an anti-VM/sandbox gate. This mechanism queries DXGI adapter vendor IDs (e.g., QEMU 0x1234, VMware 0x15AD), checks for low VRAM allocation, and performs compute shader timing analysis to detect virtualization or sandbox environments prior to secondary payload execution.
This rule detects potential Adversary-in-the-Middle (AiTM) phishing attacks targeting Microsoft 365. It monitors for suspicious network connections to known Evilginx-style subdomains (e.g., owa, sso, secure, billing) that proxy traffic to login.microsoftonline.com, followed immediately by a successful user login event on the same host. This pattern indicates an active session hijacking attempt designed to capture session cookies like ESTSAUTH and ESTSAUTHPERSISTENT.
Detects the Miasma loader, associated with supply chain attacks on NPM packages (e.g., ShinyHunters campaign), spawning a hidden, detached Node.js child process during module import. The detection monitors for a Node.js process spawning a child node.exe with the '-e' flag and a specific obfuscated variable prefix used by the malware to execute malicious code while bypassing --ignore-scripts.
Detects the execution of a process named 'AppLaunch.exe' from a directory other than the standard .NET Framework installation paths. Adversaries may masquerade as this legitimate .NET binary to evade detection, as it is a trusted system utility.
This rule detects file-level activity associated with the known malicious version of the ModHeader browser extension (Extension ID: idgpnmonknjnojddfkpgkljpfnnfcklj). It flags the presence of specific indexedDB LevelDB files and temporary directories that are characteristic of the malicious update, which was used for unauthorized data access and browser-based persistence.
Detects a hidden, non-interactive PowerShell process that programmatically enumerates mounted disk images (VHDX/ISO) using Get-DiskImage or Get-Partition, dismounts them, and potentially deletes the backing files. This behavior is indicative of post-execution cleanup routines used by malware delivered via mounted container images, such as the Overlord RAT.
This rule detects potential OAuth Device Code Flow phishing attacks where users are directed to malicious lure pages on romnor[.]ca to enter a Microsoft device code. It also alerts on authentication activity associated with a specific malicious OAuth client ID (d3590ed6-52b3-4102-aeff-aad2292ab01c) known to be used by a phishing backend to poll and claim OAuth tokens.
Detects when the administrative user account for an Azure Container Registry (ACR) is enabled. Enabling the admin user creates a static username and password for registry access, which may bypass modern identity-based access controls like Microsoft Entra ID (formerly Azure AD) and increase the risk of credential-based attacks.
Page 5 of 92