Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,374 downloads4,081 copies490 likes318,459 views
919 detections
Filters
Last updated
All Time
Detection languages
328
314
163
59
21
Categories
261
235
219
212
173
Platforms
417
384
97
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
299
272
245
191
185
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
This rule detects inbound network traffic associated with the Braodo Loader malware. It specifically looks for a unique byte sequence and a specific string within the HTTP response body, indicating the download or communication related to this loader.
This rule detects the inbound transfer of a KoiStealer payload over HTTP. It specifically looks for unique string patterns within the HTTP response body that are indicative of the KoiStealer malware, including specific context definitions and keywords like 'CONTEXT_i386', 'CONTEXT_i486', 'CONTEXT_CONTROL', and 'CONTEXT_INTEGER'. This suggests the rule is designed to identify the download of the malware executable or a component of it.
This rule detects the presence of 'activeMQConnectionURL' and 'tcp://' within HTTP response bodies, which is indicative of a Commvault server exposing its hostname or connection details. This information could be leveraged by attackers for reconnaissance or to identify vulnerable Commvault instances.
ET WEB_SPECIFIC_APPS Netgear password.cgi http_passwd Parameter Command Injection Attempt
ET WEB_SPECIFIC_APPS D-Link setMAC macCloneMac Parameter Buffer Overflow Attempt (CVE-2023-43237)
ET MALWARE Observed Malicious Domain (tamku .shoplerter .opnetorologies .net in TLS SNI)
ET INFO Blockchain RPC Domain in TLS SNI (mainnet .optimism .io)
This rule detects attempts to exploit a vulnerability in Xerox FreeFlow Core (CVE-2025-8356) that allows for arbitrary file upload and directory traversal. The detection logic looks for HTTP POST requests with a specific content type ('multipart/related' and 'application/vnd.cip4-jmf+xml') and a 'Content-Disposition: attachment; filename="' header, combined with a PCRE regex matching directory traversal patterns (e.g., '../', '..\'). This indicates an attacker is trying to upload a malicious file or traverse directories on the server.
ET ATTACK_RESPONSE Koi Loader/Stealer CnC Config Inbound
Detects the enablement of the Hyper-V feature, particularly when the management clients are disabled simultaneously. This combination of actions is a technique used by the Curly COMrades threat actor to create a hidden virtualized environment for evasion purposes.
Page 70 of 92