Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,213 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects mshta.exe launched with an inline javascript: one-liner that chains MSXML2.XMLHTTP to download, ADODB.Stream to write to disk, and WScript.Shell to execute. This identifies the ClickFix social engineering variant that fetches and executes payloads without using PowerShell.
Detects browser cache smuggling (ClickFix/FileFix delivery mechanisms) where a non-browser script interpreter or LOLBin accesses a browser HTTP-cache directory and writes an executable or script payload outside the cache, followed shortly by the execution of a payload from a user staging directory.
Detects a potential app-only tenant-takeover sequence associated with Storm-3119 (YAM Store), where a single service principal performs an administrative password reset, a license assignment, and a privileged role grant within a one-hour window.
Detects a single application or service principal performing a password reset, a license assignment, and a privileged role grant within a one-hour window. This sequence matches Storm-3119 admin-panel abuse of a compromised tenant client secret through an app-only flow in Microsoft 365 or Entra ID.
Detects PowerShell launched hidden and non-interactive with an insecure execution policy and Base64 decode-and-execute, or a script combining Base64 decode-and-execute with browser history collection and WMI shadow copy enumeration, as seen in the Midnight Blizzard (GTG-20006) stager.
Detects the WinLol Rust dropper staging a DLL sideload by writing a copy of Microsoft OneDrive.exe and a proxy version.dll into a user temp directory by a non-OneDrive, non-installer process.
Detects a renamed PSF-signed pythonw.exe (with an original file name of pythonw.exe but a different on-disk name) launched from a user-writable path under Users. The command line consists only of its own path, which is consistent with ._pth based path configuration abuse for loading attacker code stealthily.
Detects the execution of rundll32.exe loading a DLL directly from common browser cache directories (Firefox, Chrome, or Edge), which is indicative of the SensePost cache-smuggling proof-of-concept technique.
Detects the launch of bad-bpf style eBPF rootkit loaders (pidhide with --pid-to-hide, sudoadd with --username) executed via sudo or from an interactive shell parent, representing the userspace step that issues bpf(BPF_PROG_LOAD) before tracepoint hooks go live.
Detects the AnyDesk Linux service running as root spawning a shell process (sh, bash, dash, zsh) or executing a command associated with the AnyPwn (CVE-2025-27918) post-exploitation behavior.
Page 1 of 92