Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,374 downloads4,081 copies490 likes318,457 views
919 detections
Filters
Last updated
All Time
Detection languages
328
314
163
59
21
Categories
261
235
219
212
173
Platforms
417
384
97
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
299
272
245
191
185
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
ET ATTACK_RESPONSE Observed AsyncRat Installer Inbound
ET ATTACK_RESPONSE TA399 Fake 404 WebPage Inbound
This rule detects attempts to exploit a command injection vulnerability (CVE-2025-57105) in D-Link devices. Specifically, it looks for HTTP GET requests to '/mng_platform.asp' where the 'addr' parameter contains characters commonly used for command injection, such as semicolons, newlines, backticks, pipes, or dollar signs, which could lead to arbitrary command execution on the device.
This rule detects an attempt to exploit a buffer overflow vulnerability (CVE-2025-9299) in Tenda routers. The exploit targets the `/goform/getMasterPassengerAnalyseData` endpoint via an HTTP POST request, specifically looking for an overly long 'time' parameter in the request body, which could lead to a buffer overflow.
Lumma Stealer Payload Inbound
Suricata
This rule detects the inbound transfer of a Lumma Stealer payload over HTTP. Specifically, it looks for a unique content string within the HTTP response body, indicating the download of a DLL file associated with Lumma Stealer. The content string 'filename="fuckingdllENCR.dll"' is a strong indicator of this specific malware.
Detects process crashes within the Samsung 'libimagecodec.quram.so' library, which could indicate an exploitation attempt related to the LANDFALL spyware (CVE-2025-21042, CVE-2025-21043).
Detects outbound network connections to the OpenAI API from unusual processes, a TTP used by the SesameOp backdoor for command and control (C2).
Detects PowerShell command clobbering techniques, where a module is installed or imported with the intent to overwrite existing system commands. This can be used in supply chain attacks via repositories like PowerShell Gallery.
Detects the creation of a Keras model file (.keras) that contains suspicious file paths or URLs. This may indicate an attempt to exploit CVE-2025-12058 for local file inclusion or server-side request forgery (SSRF).
Detects the spawning of command-line interpreters (`cmd.exe` or `powershell.exe`) from processes associated with Windows Server Update Services (WSUS), such as `w3wp.exe` (IIS worker process for WSUS) and `wsusservice.exe`. This behavior is a strong indicator of post-exploitation activity related to vulnerabilities like CVE-2025-59287, where attackers gain remote code execution on the WSUS server.
Page 73 of 92