Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,374 downloads4,081 copies490 likes318,454 views
919 detections
Filters
Last updated
All Time
Detection languages
328
314
163
59
21
Categories
261
235
219
212
173
Platforms
417
384
97
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
299
272
245
191
185
CVEs
6
4
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects PowerShell commands, particularly those involving download and execution cradles (irm/iex), being written to the RunMRU registry key. This behavior is indicative of social engineering attacks like 'ClickFix' where users are tricked into pasting and running malicious commands via the Windows Run dialog.
Detects a Microsoft Office application spawning suspicious child processes to execute dropped files. This behavior is consistent with UAC-0057's use of weaponized XLS documents with VBA macros for initial access.
Enable Rdp Via Registry
YARA-L
Detects a registry modification to enable Remote Desktop Protocol (RDP) by setting the 'fDenyTSConnections' value to 0. This is a common technique used by threat actors, including those deploying KawaLocker, Medusa, and Crypto24 ransomware, to enable lateral movement or establish persistence.
Detects attempts to exploit a remote code execution vulnerability (CVE-2024-36401) in GeoServer. Attackers leverage crafted JXPath queries in WFS, WMS, or WPS requests to execute arbitrary commands via Java's getRuntime().exec() method.
Detects Component Object Model (COM) hijacking used by the Curly COMrades threat actor for persistence. This rule identifies registry modifications that alter specific CLSIDs related to the .NET NGEN task to load the MucorAgent malware.
Detects potential DLL Sideloading activity as used by LockBit ransomware operators. This rule identifies when a legitimate, signed application (e.g., MpCmdRun.exe, jarsigner.exe) loads a corresponding DLL from the same, non-standard directory, a common TTP for defense evasion.
Detects the execution of WMI-based tooling such as SharpWMI, WMICmd, or wmic.exe for remote command execution, a technique used by the threat actor UAT-7237.
Detects potential exploitation attempts against Ivanti Connect Secure devices for vulnerability CVE-2025-22457. This vulnerability is actively exploited in the wild. Attackers can send an abnormally long string composed of digits and periods in the 'X-Forwarded-For' HTTP header to trigger a stack-based buffer overflow, which can lead to remote code execution.
Detects the creation of specific ASPX web shells in the SharePoint LAYOUTS directory, a TTP associated with the exploitation of the 'ToolShell' vulnerabilities (e.g., CVE-2025-49706, CVE-2025-53770).
Page 92 of 92