Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,374 downloads4,081 copies490 likes318,457 views
919 detections
Filters
Last updated
All Time
Detection languages
328
314
163
59
21
Categories
261
235
219
212
173
Platforms
417
384
97
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
299
272
245
191
185
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects Chaos C++ ransomware payloads based on known file hashes and unique embedded strings from the malware.
Detects suspicious child processes spawned by the GoAnywhere MFT Tomcat service. This behavior is consistent with post-exploitation activity following a successful remote code execution exploit of CVE-2025-10035, as observed in campaigns by the threat actor Storm-1175.
MAL Bat Dropper
YARA
Detects a specific multi-stage batch file dropper identified by its hash. This malware uses PowerShell, VBScript, and multiple layers of obfuscation (Base64, XOR, Gzip) to deliver its payload.
Detects a PowerShell command that carves an MSI file from a source file by searching for a specific byte sequence ('UUUU' or 0x55 four times). This novel technique has been used by a Chinese APT group as part of their infection chain, often initiated by a malicious LNK file.
Detects the creation of files with names used by Yurei ransomware to masquerade as legitimate system processes or backups in unusual locations.
Detects potential exploitation of VMware CVE-2025-41244, where a privileged VMware service discovery script executes a binary from a world-writable directory like /tmp. This behavior is consistent with the local privilege escalation technique used by UNC5174.
Detects a sequence of commands associated with UAT-8099 activity, where a new user (including hidden or test accounts) is created or the guest account is enabled, and then added to the Administrators and Remote Desktop Users groups. This pattern is used for establishing persistence and remote access.
Detects potential DLL side-loading activity associated with the Confucius threat group. This rule identifies when a legitimate executable, known to be abused by Confucius (e.g., fixmapi.exe), is run from a non-standard, user-writable directory and loads a suspicious DLL from the same location.
Detects a high volume of process and service terminations using 'taskkill.exe' and 'sc.exe' within a short time frame. This behavior is characteristic of ransomware like FunkLocker, which aggressively disables applications and services to prepare for encryption.
Detects a process execution chain characteristic of the ClickFix technique, where explorer.exe spawns a headless conhost.exe, which in turn leads to the execution of curl.exe to download a payload.
Page 80 of 92