Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,374 downloads4,081 copies490 likes318,457 views
919 detections
Filters
Last updated
All Time
Detection languages
328
314
163
59
21
Categories
261
235
219
212
173
Platforms
417
384
97
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
299
272
245
191
185
CVEs
6
4
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects the compilation of an executable in a temporary directory, followed by its execution and subsequent deletion. This pattern is indicative of an adversary attempting to compile and run tools on a target system while minimizing forensic artifacts.
Detects the execution of the Ligolo-ng tunneling tool, which is used by the Silent Lynx APT group for command and control and network pivoting.
Detects DLL side-loading patterns associated with the Lazarus Group's Operation DreamJob campaign. This involves legitimate Windows executables loading malicious DLLs from non-standard paths.
Detects the use of command-line download tools to write a file with a web-related extension to a common web server directory. This behavior is consistent with webshell deployment, as seen in Sandworm campaigns.
Detects the execution of a malicious LNK file exploiting the ZDI-CAN-25373 vulnerability, a technique used by threat actors like UNC6384. The exploit involves padding the command line arguments with excessive whitespace to hide the malicious command from the user in the file's properties. This rule identifies command or powershell execution containing a large amount of whitespace characters, which is characteristic of this technique.
Detects processes with names used by Qilin malware (`hosts.exe`, `dato.exe`) that are launched without a visible window and subsequently make an outbound network connection. This pattern is indicative of a hidden C2 beacon, a technique used by Qilin to evade user detection.
Detects a process exhibiting multiple behaviors associated with Warlock ransomware. This rule correlates the termination of critical services, deletion of volume shadow copies within a short time window.
Detects the execution of legitimate tools (like sshd, tor, obfs4proxy) or their renamed counterparts from user-writable directories, specifically within AppData folders. This technique is associated with Operation SkyCloak to establish persistence and covert communication channels by masquerading as legitimate software.
Detects Airstalk malware, used by the CL-STA-1009 threat cluster. This rule identifies both PowerShell and .NET variants that misuse the AirWatch MDM API for C2 and data exfiltration.
Detects the XOR decryption function used in macOS variants of OceanLotus (APT32). This rule targets a specific byte sequence identified in the malware's decryption routine.
Page 74 of 92