Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,374 downloads4,081 copies490 likes318,455 views
919 detections
Filters
Last updated
All Time
Detection languages
328
314
163
59
21
Categories
261
235
219
212
173
Platforms
417
384
97
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
299
272
245
191
185
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects the creation of a mutex with a pattern matching new SmokeLoader versions (2025 alpha and 2025). The malware's main module is injected into explorer.exe, which then creates this distinct mutex to prevent multiple instances from running.
Detects the creation of a malicious executable named 'My Pictures.exe' on a removable drive, a technique used by VenomRAT for lateral movement.
Detects fake image files (BMP, GIF, JPEG, PNG, TIFF) used by the BeardShell backdoor for command and control communications. These files contain an encrypted payload and a size field that matches the file's total size, a technique used by APT28 in the Phantom Net Voxel campaign.
Detects a series of WMI queries used by Maranhão Stealer for system reconnaissance.
Detects attempts to add sensitive privileges to a process token, a common technique for local privilege escalation. This could be part of an exploit chain following an information disclosure vulnerability like CVE-2025-53136.
Detects the execution of a malicious Node.js payload, a technique used by the EvilAI malware campaign. EvilAI launches node.exe via cmd.exe to run a JavaScript file from the user's temporary directory. The script name follows a specific pattern (GUID followed by 'or', 'ro', or 'of').
Detects the execution of the PureCoder Rust Loader based on the specific command-line argument '/i:--type=renderer' required for its execution.
Detects potential Adversary-in-the-Middle (AiTM) phishing activity, commonly associated with frameworks like Evilginx. The rule identifies suspicious domain patterns where legitimate identity provider (IdP) domains are used as subdomains of another domain, or where IdP-related keywords are used in hyphenated subdomains.
Detects a sequence of file creations (.svg, .zip, .bat) on a single host within a short time window, which is indicative of a malicious SVG-based download campaign delivering payloads like XWorm and Remcos.
Detects persistence mechanisms associated with a Winos malware variant. This includes the creation of the 'Software\DeepSer' registry key or the modification of the 'User Shell Folders\Startup' key to redirect to a malicious folder.
Page 85 of 92