Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,374 downloads4,081 copies490 likes318,454 views
919 detections
Filters
Last updated
All Time
Detection languages
328
314
163
59
21
Categories
261
235
219
212
173
Platforms
417
384
97
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
299
272
245
191
185
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects the __DAEMONIZED=1 environment variable marker used by the vpmdhaj npm supply chain campaign (Mini Shai-Hulud) to spawn a detached credential-harvesting payload during npm install. This marker prevents re-entry when payload.bin is re-launched on subsequent require() calls. Microsoft explicitly recommends this detection, noting that the exact string __DAEMONIZED=1 has no legitimate npm ecosystem use, leading to near-zero false positives.
Detects COM hijacking of the Windows Color System Calibration Loader CLSID ({B210D694-C8DF-490D-9576-9E20CDBC20BD}). The Argamal RAT abuses this specific CLSID by modifying the InprocServer32 key in the user hive to establish startup persistence tied to user login via a default Windows scheduled task.
Detects Atlas RAT anti-analysis behavior by monitoring for registry queries or interactions with the Windows Defender Application Guard (WDAG) RunOnce registry key. This rule specifically looks for registry events where the key name contains "RunOnce" and the value name contains "WDAG", indicating an attempt by malware to detect or interact with a sandbox environment.
Detects the use of the `nsenter` utility targeting PID 1 to spawn a shell. This is a common container escape technique used to break out of a privileged container and execute commands on the underlying host.
Detects the creation or modification of the 'DontOfferThroughWUAU'
registry value under the Microsoft MRT policy key. This is a known defense
evasion technique used by malware, such as the SilentCryptoMiner campaign, to
permanently prevent the Microsoft Malicious Software Removal Tool (MSRT) from
automatically updating or installing via Windows Update.
registry value under the Microsoft MRT policy key. This is a known defense
evasion technique used by malware, such as the SilentCryptoMiner campaign, to
permanently prevent the Microsoft Malicious Software Removal Tool (MSRT) from
automatically updating or installing via Windows Update.
Detects creation or manipulation of the ROTATE subdirectory within the Skylight Metrics Agent path by non-SYSTEM accounts. CVE-2026-7791 exploitation requires replacing the legitimate ROTATE directory with a junction point targeting the attacker's desired write location. The Skylight service then follows the junction during its log rotation, writing attacker-controlled files to the target with SYSTEM privileges. Any non-SYSTEM interaction with this specific path warrants investigation.
Detects attempts to read common HashiCorp Vault token paths from the filesystem, indicating potential credential harvesting by malware like Miasma stealer.
This rule looks for URL patterns matching common SQLi keywords used to break out of the array key for CVE-2026-9082.
Detects sign-in or Microsoft Graph API activity using user-agent strings characteristic of ROADtools and similar Python-based identity-attack tooling. The rule generalizes beyond ROADtools to catch AzureHound, MicroBurst, MFASweep, GraphRunner, and similar identity attack frameworks by looking for scripting user-agents (python, requests, urllib, curl) which signal non-browser, non-app authentication that is inherently suspicious for Entra ID admin operations.
Detects PowerShell script block telemetry (Event ID 4104) containing P/Invoke declarations targeting advapi32.dll's CredEnumerate function or related Credential Manager APIs (CredRead, CredWrite). This technique bypasses standard cmdlets that may be monitored or restricted, providing direct API access to stored Windows credentials including RDP sessions, web service credentials, and enterprise application tokens. Generalizes well beyond specific campaigns to most PowerShell credential-theft families.
Page 9 of 92