Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,374 downloads4,081 copies490 likes318,454 views
919 detections
Filters
Last updated
All Time
Detection languages
328
314
163
59
21
Categories
261
235
219
212
173
Platforms
417
384
97
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
299
272
245
191
185
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects a sign-in failure with error code 50199 (indicating a device-code interrupt/waiting state) followed immediately by a successful sign-in from the same source IP address. This pattern is characteristic of device-code phishing attacks, where an attacker intercepts a device code and completes the authentication process on behalf of the victim.
Detects Microsoft Entra ID sign-in events using the non-interactive OAuth device-code protocol against the 'common' tenant endpoint where MFA was not applied. This behavior is consistent with OAuth device-code phishing campaigns (e.g., Storm-2372/DEBULL) that exploit Conditional Access device-code flow allowances to bypass standard authentication controls.
Detects obfuscated PowerShell execution (utilizing common bypass and hiding flags) that subsequently spawns the C# compiler (csc.exe) from suspicious locations (AppData, Temp, or tmp directories). This pattern is consistent with fileless payload delivery and runtime compilation, such as that observed in recent NeptuneRAT campaigns leveraging Chrome Native Messaging.
Detects the PureLog Stealer performing system and process reconnaissance using .NET capabilities reflectively loaded via PowerShell. The rule monitors for the combination of process enumeration (System.Diagnostics.Process/Win32_Process), system metadata harvesting (Environment class properties), and memory-only execution patterns (Reflection.Assembly.Load) within PowerShell script block logs.
Detects execution of 'npm install' or 'npm ci' commands that explicitly include '@marketfront' or '@tqm-mfe' scopes. This detection is designed to identify potential dependency confusion attacks where malicious actors publish public packages with the same names as internal private packages to trick build systems into downloading malicious code instead of legitimate internal modules.
Detects adversary cleanup activities where PowerShell is used to remove script files and shortcuts (.lnk, .js, .bat, .vbs) from common persistence and startup directories (APPDATA, PUBLIC, ProgramData, and Startup folder), often associated with Veil#Drop anti-forensic techniques.
Detects the execution of npm install commands that include known malicious package names associated with a supply chain attack linked to the Lazarus Group. These packages are designed to impersonate the legitimate 'rollup-plugin-polyfill-node' package.
Detects ClickFix clipboard-paste payloads by identifying fake 'human verification' comments embedded in the command line of commonly abused Living Off the Land Binaries (LOLBINs). These comments are used by attackers to disguise malicious commands as CAPTCHA steps (e.g., reCAPTCHA, Cloudflare Turnstile, 'not a robot', verification-id, Ray ID). This rule is technique-level and not actor-specific, complementing the ErrTraffic rule.
Detects exploitation activity associated with CVE-2025-8088 used by UAC-0226 (GIFTEDCROOK). The rule monitors for WinRAR-family archive tools dropping files into the startup folder, staging payloads into C:\ProgramData, and the subsequent logon execution chain where cmd.exe launches PowerShell to execute encoded commands or content from ProgramData.
EXPERIMENTAL: This rule detects RoguePlanet indicators when the Microsoft Defender Antimalware Service Executable (MsMpEng.exe) creates or modifies an executable (.exe, .dll, .sys) file within the System32 or SysWOW64 directories. This behavior can indicate a potential local privilege escalation (LPE) or other malicious activity, especially if Defender is being abused for remediation in a SYSTEM context. The rule specifically highlights 'wermgr.exe' as a high-interest target, but is generalized to catch any PE file.
Page 6 of 92