Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,374 downloads4,081 copies490 likes318,455 views
919 detections
Filters
Last updated
All Time
Detection languages
328
314
163
59
21
Categories
261
235
219
212
173
Platforms
417
384
97
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
299
272
245
191
185
CVEs
6
4
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Zloader Custom DNS C2
YARA-L
Detects Zloader's custom DNS tunneling protocol which uses multiple Base32 encoded subdomains for C2 communication.
Detects LESLIELOADER, a Go-based malware loader used by the Chinese state-sponsored group RedNovember (TAG-100, Storm-2077) to deliver payloads such as SparkRAT and Cobalt Strike.
Detects a PowerShell process launch shortly after a .LNK file was created by Discord. This pattern is indicative of malicious LNK files distributed via Discord to gain initial execution.
Detects the registration of a new IIS module using appcmd.exe, a technique used by adversaries to install malicious components like the BadIIS module for persistence and traffic interception. This rule looks for the specific 'chongxiede' module name or modules registered from suspicious file paths.
Detects the use of AWS IAM Policy Simulator APIs (SimulatePrincipalPolicy, SimulateCustomPolicy), which can indicate a threat actor is enumerating permissions to find privilege escalation paths.
Detects loaders associated with RainyDay, Turian, and a new PlugX variant, used by threat actors like Naikon and BackdoorDiplomacy. The rule identifies the shared unpacking routine which uses a combination of RC4 decryption and LZNT1 decompression (via RtlDecompressBuffer), along with specific RC4 keys, PDB paths, and hardcoded payload filenames.
Detects potential Cloudflare Under Attack Mode (UAM) bypass activity, characteristic of the ShadowV2 botnet. This involves the execution of a headless browser followed by network requests using a Cloudflare clearance cookie.
Detects a Windows command shell executing a batch file that subsequently spawns processes for system discovery (often for AV checking) and then either executes a potential payload or performs network reconnaissance. This behavior is consistent with the initial stages of the BlockBlasters malware campaign.
Detects the multi-stage DLL sideloading technique used by the Nimbus Manticore APT group. This rule identifies when the legitimate Windows Defender component 'SenseSampleUploader.exe' loads 'xmllite.dll' from a non-standard directory, a behavior indicative of the group's novel DLL path hijacking method.
Detects the execution of the Oracle Database Scheduler's External Job process (`extjobo.exe`) spawning a suspicious child process, such as PowerShell with an encoded command or the Windows Command Shell. This behavior was observed in Elons ransomware attacks for initial access and remote command execution.
Page 83 of 92