Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,374 downloads4,081 copies490 likes318,454 views
919 detections
Filters
Last updated
All Time
Detection languages
328
314
163
59
21
Categories
261
235
219
212
173
Platforms
417
384
97
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
299
272
245
191
185
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects the execution of the 'search:' or 'search-ms:' URI handlers utilizing the 'crumb=location:' parameter pointing to a UNC path. This behavior forces outbound NTLM authentication and can be abused to leak Net-NTLMv2 hashes, exploiting an unpatched vulnerability similar to CVE-2026-33829 in the Snipping Tool.
This rule detects the creation of suspicious child processes by 'lsass.exe' on Windows systems. LSASS (Local Security Authority Subsystem Service) is a critical Windows process responsible for enforcing security policies. Under normal circumstances, LSASS should not spawn common command-line interpreters or system utilities like cmd.exe, powershell.exe, or rundll32.exe. Such activity is highly indicative of post-exploitation behavior, potentially following a successful compromise like the referenced CVE-2026-41089 Netlogon RCE, where an attacker might use LSASS to execute further commands or tools.
Detects the execution of Google Chrome with specific command-line flags (--hide-crash-restore-bubble and --disable-session-crashed-bubble) that are often used by malware like FlutterShell to suppress crash recovery prompts and potentially evade detection or user interaction. This behavior can indicate an attempt to hide malicious activity or maintain persistence without alerting the user to abnormal browser states.
Detects unusual or suspicious child processes spawned by 7-Zip (7z.exe or 7zG.exe). This behavior is indicative of post-exploitation activity following a successful vtable hijack via the CVE-2026-48095 NTFS heap buffer overflow vulnerability.
Detects browser processes making DNS queries or network connections to BNB Smart Chain RPC endpoints (and related EVM-compatible chain RPCs). This technique is a signal for EtherHiding-style attacks where malicious JavaScript injected into compromised websites queries smart contracts for payload retrieval. This generalizes beyond ClearFake to catch UNC5342 (North Korean DPRK) and other EtherHiding adopters documented since October 2025.
Detects co-occurrence of MicrosoftSystem64 binary execution and DNS queries to huggingface.co from the same host within a 5-minute window. MicrosoftSystem64 is a DPRK-attributed (FAMOUS CHOLLIMA / Contagious Interview) multi-platform RAT delivered via malicious npm packages that exfiltrates stolen credentials, screenshots, and wallet data to attacker-controlled HuggingFace datasets. SafeDep confirmed the exfiltration pipeline was actively operating with real victims as of May 28, 2026.
Detects Quick Assist spawning command interpreters (cmd.exe, powershell.exe, pwsh.exe) that execute common discovery and reconnaissance commands. This pattern is associated with hands-on-keyboard activity, as documented in campaigns like Nimbus RAT, and broader kill chains used by groups such as Storm-1811, Black Basta affiliates, and 3AM ransomware operators. The rule specifically looks for commands like 'whoami', 'ipconfig', 'systeminfo', 'hostname', 'net time', 'net user', 'net group', 'net localgroup', 'net view', 'nltest', 'qwinsta', 'tasklist', 'arp', 'route', 'netstat', '/domain', 'dsquery', and 'gpresult'.
ASP.NET ViewState Verification Failure
Cortex XDR
This rule detects ASP.NET ViewState verification failures, specifically looking for Event ID 1316 and event message containing 'Event code: 4009'. This can indicate an attempt to tamper with the ViewState, potentially leading to deserialization vulnerabilities or other web application attacks.
Detects the creation or modification of Exchange inbox rules used by Kali365 designed to suppress security alerts by moving, deleting, or marking as read emails containing specific keywords. This technique is often used by adversaries to hide their activities or prevent detection.
Detects the creation of the specific named pipe '\REDSUN' used by the RedSun exploit (CVE-2026-41091) for inter-process communication. This named pipe is a unique indicator of the RedSun exploit's activity, often associated with process injection or other inter-process communication mechanisms.
Page 8 of 92