Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,374 downloads4,081 copies490 likes318,454 views
919 detections
Filters
Last updated
All Time
Detection languages
328
314
163
59
21
Categories
261
235
219
212
173
Platforms
417
384
97
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
299
272
245
191
185
CVEs
6
4
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects the execution of a malicious Linux payload, possibly within a .desktop file, a technique used by APT36. The rule identifies a bash process executing an inline command that downloads and runs a payload, often using a combination of curl, xxd, base64, and eval.
Detects TOSHIS malware, a loader used in the TAOTH campaign to deploy Cobalt Strike or Merlin Agent. This rule identifies the malware based on unique strings found in the payload.
Detects potential DLL side-loading of the CANONSTAGER malware, which is used to deploy the SOGU.SEC backdoor. This rule identifies when the legitimate, signed Canon IJ Printer Assistant Tool (cnmpaui.exe) loads an unsigned DLL with a similar name (cnmpaui.dll) and subsequently reads a .dat file (cnmplog.dat), consistent with the TTPs of the PRC-nexus actor UNC6384.
Detects attempts to enable WDigest credential caching by modifying the 'UseLogonCredential' registry value. This allows plaintext credentials to be stored in memory, which can then be harvested by attackers. The threat group ShadowSilk has been observed using this technique.
Detects the use of curl.exe to exfiltrate data, particularly archived or disguised files, via HTTP POST requests or the '--upload-file' flag. This technique was observed being used by the 'Curly COMrades' threat actor to upload .rar archives to a compromised server.
Detects when new credentials are added to an Entra ID Service Principal, followed by a successful login from that principal within a short time frame. This pattern is consistent with MURKY PANDA TTPs for lateral movement and persistence in cloud environments.
Detects the execution of a shell script downloaded via curl or wget on macOS, a technique associated with ClickFix campaigns delivering malware like Atomic macOS Stealer (AMOS).
Detects the execution of legitimate file transfer or backup utilities like FileZilla (fzsftp.exe), Restic, or BackBlaze (b2.exe) that have been observed being abused by threat actors for data exfiltration.
Detects the execution of a legitimate SentinelOne executable, 'SentinelBrowserNativeHost.exe', from a suspicious location (such as user profile, ProgramData, or Temp directories), which then sideloads a malicious 'SentinelAgentCore.dll'. This is a technique used by Cephalus ransomware.
Detects defense evasion tactics used by UpCrypter, such as checking for forensic tools or sandbox environments.
Page 91 of 92