Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,374 downloads4,081 copies490 likes318,457 views
919 detections
Filters
Last updated
All Time
Detection languages
328
314
163
59
21
Categories
261
235
219
212
173
Platforms
417
384
97
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
299
272
245
191
185
CVEs
6
4
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects changes to payment or bank account information in Workday. This activity is associated with 'payroll pirate' attacks by threat actor Storm-2657, who modify payroll details to divert salary payments after compromising an account.
Detects a potential Oracle E-Business Suite (EBS) authentication bypass attempt, associated with the exploitation of CVE-2025-61882. This activity involves an HTTP POST request to the '/OA_HTML/SyncServlet' endpoint, which is the initial step observed in the exploit chain used by threat actors like GRACEFUL SPIDER.
Detects HTTP responses containing JavaScript associated with ClickFix phishing kits. These kits manipulate the DOM to mimic browser verification pages and trick users into copying and executing malicious commands.
Detects .NET DLLs containing hardcoded Azure Storage Account credentials, such as access keys or SAS tokens. This technique was observed in the Axis Communications plugin for Autodesk Revit, where it could have enabled a supply chain attack.
Detects PowerShell being used to modify Group Policy Objects (GPOs) to disable Windows Defender security features. This technique is used by threat actors like Storm-2603 for defense evasion.
Detects a variety of HTTP exploitation attempts associated with the RondoDox botnet campaign. This campaign uses a 'shotgun' approach, targeting numerous vulnerabilities in internet-facing devices like routers, DVRs, and web servers.
Detects command execution characteristic of the AntSword web shell's virtual terminal feature. This is identified by a web server process spawning a child process with a specific command-line structure, often involving `cmd.exe` and echoing unique start and end tags (`stag`/`etag`).
Detects DLL side-loading activity consistent with the Mustang Panda Claimloader malware. This rule looks for a process loading a DLL from its own directory, a common side-loading pattern. It specifically targets IOCs from the Claimloader campaign (e.g., decoy executable metadata and malicious DLL names) or a more generic pattern where an executable in a suspicious location loads a DLL.
Detects attempts to exploit a SQL injection vulnerability (CVE-2025-57819) in FreePBX via a malicious GET request to '/admin/ajax.php'. Attackers leverage this to achieve remote code execution by inserting a malicious cron job.
Detects a process launched by the Windows Task Scheduler from a non-standard directory that immediately loads a DLL from the same directory. This is a strong indicator of DLL Sideloading for persistence, as seen in campaigns by groups like ToddyCat.
Page 79 of 92