Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,374 downloads4,081 copies490 likes318,460 views
919 detections
Filters
Last updated
All Time
Detection languages
328
314
163
59
21
Categories
261
235
219
212
173
Platforms
417
384
97
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
299
272
245
191
185
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects a process accessing multiple files related to known cryptocurrency wallets or browser extensions. This behavior is indicative of information stealers like LeakyStealer attempting to exfiltrate sensitive wallet data.
This rule detects the 'Stop-ScheduledTask' PowerShell cmdlet within the HTTP response body, indicating that a client on the internal network is receiving a command to stop a scheduled task. This could be part of an adversary's attempt to disable persistence mechanisms or disrupt system operations.
This rule detects attempts to exploit a buffer overflow vulnerability in Tenda routers via the `/goform/exeCommand` endpoint. Specifically, it looks for HTTP POST requests to this URI where the `cmdinput` parameter contains an unusually long string (100 characters or more) which is indicative of an attempt to overflow a buffer.
ET WEB_SPECIFIC_APPS Tenda SafeClientFilter page Parameter Buffer Overflow Attempt (CVE-2025-12232)
ET WEB_SPECIFIC_APPS Tenda SetIpBind page Parameter Buffer Overflow Attempt (CVE-2025-12235)
ET WEB_SPECIFIC_APPS Ilevia mbus_build_from_csv.php Multiple Parameters Command Injection Attempt (CVE-2025-34513)
ET WEB_SPECIFIC_APPS Brickcom syslog.dump action Parameter Information Disclosure Attempt (CVE-2017-9238)
ET WEB_SPECIFIC_APPS Syrotec/GPON shellCMDExec command Parameter Command Injection Attempt (CVE-2024-46658)
ET WEB_SPECIFIC_APPS Netgear password.cgi http_passwd Parameter Buffer Overflow Attempt (CVE-2023-38925)
ET WEB_SPECIFIC_APPS Tenda WifiExtraSet wpapsk_crypto Parameter Buffer Overflow Attempt (CVE-2025-25663, CVE-2025-10838, CVE-2025-7596, CVE-2025-5799)
Page 62 of 92