Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,374 downloads4,081 copies490 likes318,454 views
919 detections
Filters
Last updated
All Time
Detection languages
328
314
163
59
21
Categories
261
235
219
212
173
Platforms
417
384
97
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
299
272
245
191
185
CVEs
6
4
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects a LOLBAS (Living Off the Land Binary) executing a payload from a common staging directory, which is then followed by an outbound RDP connection from the same process. This behavior is indicative of a proxied RDP connection, often used for lateral movement after an initial compromise, as seen with malware like SystemBC.
Detects an exploit attempt against Sitecore vulnerability CVE-2025-53690. This rule correlates an HTTP POST request to '/sitecore/blocked.aspx' with a subsequent 'ViewState verification failed' Windows Event Log (EID 1316) from the same source IP and target host.
Detects multiple failed Multi-Factor Authentication (MFA) push attempts for a user from a single IP address, followed by a successful attempt within a short time window. This pattern can indicate an MFA push bombing or fatigue attack where an adversary spams a user with MFA requests until they approve one.
Detects a high frequency of 'shell' processes spawned by the same parent process, a behavior indicative of the LunoBotnet's watchdog-based self-healing and persistence mechanism. The parent process often masquerades as a kernel worker.
This rule detects potential C2 communication patterns associated with the NightshadeC2 botnet. It looks for outbound TCP connections from non-browser processes to specific ports used by the malware, or connections to Steam community pages which are used to host C2 addresses. It also identifies initial geo-IP lookups from non-browser processes.
Detects the use of 'curl' on macOS with specific flags (-f, -s, -L) commonly used to download and execute scripts from the internet. This pattern is a known technique used by malware like AMOS Stealer to gain initial access by tricking users into running malicious commands in the Terminal.
Detects the loading of `libcef.dll` by `vcpktsvr.exe` from non-standard directories. This specific DLL Sideloading behavior is a key tactic of the malware associated with the Termncolor/Colorinal malicious Python packages, where a legitimate executable is dropped into an unusual location to load a malicious DLL.
This rule detects a suspicious file download from a known web server or SQL related process which has been identified in the GhostRedirector campaign.
Detects incoming emails that contain suspicious attachment types (e.g., RAR, ZIP) or links to file-sharing services, combined with subject lines commonly used in phishing campaigns. This pattern is indicative of initial access attempts via spear-phishing.
Detects a sequence of events indicative of privilege escalation via TrustedInstaller token manipulation, a technique used by MostereRAT. The rule looks for a process starting the 'TrustedInstaller' service and then immediately launching a new process as the SYSTEM user.
Page 87 of 92