Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,374 downloads4,081 copies490 likes318,457 views
919 detections
Filters
Last updated
All Time
Detection languages
328
314
163
59
21
Categories
261
235
219
212
173
Platforms
417
384
97
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
299
272
245
191
185
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects a suspicious Salesforce OAuth login followed by high-volume data exfiltration activity within a short period. This pattern is associated with the threat actor UNC6040, which uses malicious or compromised OAuth applications to steal data.
Detects the loading of version.dll from a non-standard directory, a technique associated with DLL Sideloading. This specific variant was observed being used by a loader for TorNet and PureHVNC.
Detects the execution of a script file (e.g., VBS, JS, BAT, PS1) from a removable drive using a common script interpreter. This technique is used by the threat actor Tangerine Turkey for initial access.
Detects potential exploitation of Motex LANSCOPE Endpoint Manager (CVE-2025-61932). This rule identifies when a process listening on TCP port 443 receives an inbound connection and subsequently spawns a suspicious child process (like cmd.exe or powershell.exe), a behavior consistent with exploiting a remote service vulnerability.
Detects the modification of the WDigest registry key to enable plaintext credential caching. This technique is used by threat actors like the Qilin ransomware group to harvest credentials from memory using tools like Mimikatz.
Detects inbound emails with a Virtual Hard Disk (VHDX) file attachment. This technique has been used by APT-C-60 to deliver the SpyGlace backdoor, often disguised as a job application.
Detects Component Object Model (COM) hijacking used by the ForumTroll APT group for persistence. This rule identifies modifications to the registry where a malicious DLL is registered to be loaded by legitimate processes by overriding the CLSID for twinapi.dll in the HKEY_CURRENT_USER hive.
Detects potential DLL sideloading associated with the Lazarus Group's DreamLoader campaign. This involves legitimate Windows executables (wkspbroker.exe, wksprt.exe) being executed from non-standard directories shortly after a DLL is created in the same location.
Detects the use of msiexec.exe to remotely download and execute an MSI package, which then spawns an encoded PowerShell command. This TTP is associated with NetSupport RAT loaders.
Detects an NTLM authentication attempt with an empty username field. This is a key indicator of the NTLM LDAP authentication bypass vulnerability (CVE-2025-54918), where an attacker coerces a SYSTEM account authentication and relays it to LDAP.
Page 75 of 92