Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,374 downloads4,081 copies490 likes318,457 views
919 detections
Filters
Last updated
All Time
Detection languages
328
314
163
59
21
Categories
261
235
219
212
173
Platforms
417
384
97
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
299
272
245
191
185
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects the creation of suspicious script files (.vbs, .js, .ps1, .bat, .cmd) in the Windows Startup folder. This is a common persistence technique used by malware, including XWorm, to ensure execution upon user logon.
Detects the FlipSwitch Proof-of-Concept (PoC) Linux rootkit. This rootkit is designed to bypass modern Linux kernel (v6.9+) defenses by patching call instructions within the x64_sys_call function, a technique dubbed 'FlipSwitch'.
Detects a suspicious process or Living-Off-the-Land Binary (LOLBin) being launched by a Microsoft SQL Server process (sqlservr.exe). This behavior is often indicative of post-exploitation activity after a database server has been compromised.
Detects a suspicious sequence where a JavaScript file is executed, followed shortly by the execution of a Windows Installer (MSI) package on the same host. This pattern is consistent with the initial access technique used by threat actors like Lunar Spider, where a malicious script downloads and runs a subsequent payload.
Detects Acreed infostealer's cryptocurrency clipper activity. This rule identifies when a host first communicates with a known Acreed C2 domain (`trustdomainnet.live`) to fetch malicious wallet addresses, and then communicates with a QR code generation API (`api.zile42o.dev`) used to replace legitimate QR codes with malicious ones.
Detects potential BRICKSTORM C2 activity. This rule identifies processes initiating a WebSocket connection over HTTPS, which is a technique used by BRICKSTORM for its command and control channel. The rule filters for processes that lack file metadata, a common characteristic of Go-based malware like BRICKSTORM.
Detects Olymp Loader defense evasion techniques, such as disabling Windows Defender features or adding broad folder exclusions via PowerShell, and the execution of a known 'Defender Remover' tool.
Detects registry modifications associated with the Gentlemen ransomware group. These changes are intended to weaken security controls for NTLM, Remote Desktop Protocol (RDP), and administrative access to facilitate lateral movement and persistence.
Detects exploitation attempts against common network edge devices (Cisco, Ivanti, Palo Alto) associated with Salt Typhoon's TTPs for initial access.
Detects the creation or modification of a GitHub Actions workflow file that attempts to exfiltrate secrets. This pattern is associated with the Shai-Hulud worm, which injects malicious workflows to steal credentials using `toJSON(secrets)` and exfiltrate them using tools like `curl` and `base64`.
Page 81 of 92