Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,219 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
FDMTP C2 Registration Request
Cortex XDR
Detects network HTTP requests to the '/GetCluster' endpoint containing the 'DotNet-TcpDmtp' protocol parameter, a specific C2 registration pattern used by the updated FDMTP backdoor.
This rule detects potential exploitation of CVE-2026-4892 by correlating inbound DHCPv6 traffic (UDP/547) with a dnsmasq process crash (SIGSEGV/SIGABRT exit codes 132, 134, 135, 139) on the same host within a 60-second window. This vulnerability involves sending crafted DHCPv6 messages with oversized Client Identifier options to a dnsmasq server configured with --dhcp-script, leading to a denial of service.
Detects the registration of the PLURIBUS Cloud Files sync provider used by the CVE-2023-36036 (cldflt.sys heap overflow) privilege escalation exploit in the Rapid7-documented ModeloRAT incident. The exploit registers a fake sync provider with the specific GUID {904EE598-0511-4664-82A8-22C4A7501044} pointing to %TEMP%\cldflt\, then writes a placeholder file (Link.log) to trigger the vulnerable code path. The provider GUID, name, and registry path are all unique to this exploit variant — legitimate sync providers (OneDrive, Dropbox, Box) use vendor-specific GUIDs and never register under %TEMP%.
Detects dnsmasq or its DHCP helper child process terminating abnormally on Linux hosts due to signals like SIGSEGV, SIGABRT, SIGBUS, or SIGILL. This behavior is indicative of a crash, potentially caused by exploitation attempts of vulnerabilities such as CVE-2026-4892, a heap buffer overflow in dnsmasq's helper.c when processing oversized DHCPv6 Client Identifier (CLID) options. This rule fires post-impact, complementing network-side detections.
Detects the creation or modification of the 'FsTx' directory within 'System Volume Information' on any volume, which is a staging step required by the YellowKey BitLocker bypass (Windows 11, Server 2022/2025). The attacker copies the FsTx folder to either a USB stick's System Volume Information directory OR the target machine's EFI System Partition, then reboots into WinRE while holding CTRL to trigger a shell with unrestricted access to the BitLocker-protected volume. The FsTx folder name has no legitimate use; modifications to System Volume Information by non-system processes are inherently suspicious.
POW Proxy-over-Web Custom HTTP Headers
Cortex XDR
Detects HTTP traffic containing the custom POST headers used by the SHADOW-AETHER-064 'POW' (Proxy over Web) tool to encapsulate SOCKS5 traffic inside HTTP requests forwarded through JSP webshells. The full header set per Trend Micro's analysis is X-Act, X-Sid, X-Host, X-Port, and X-Status. The X-Act header carries one of five specific command values (CONNECT, SEND, RECV, DISCONNECT, PING) which provides an additional fidelity boost. The combination of two or more of these headers in a single HTTP transaction is exclusive to the POW tool.
Detects execution of Python with PySoxy SOCKS5 proxy arguments (-ssl, -remote_port, -remote_ip) alongside compiled bytecode (.pyc) execution. PySoxy is a 10-year-old open-source SOCKS5 proxy that ReliaQuest observed being deployed via ClickFix as a secondary encrypted access path alongside PowerShell-based C2. The specific combination of these three argument flags with .pyc execution is rare in legitimate use and represents the PySoxy invocation pattern verbatim.
Detects behavioral characteristics of the Needle Rust desktop agent: an unsigned Rust PE in the 5-50MB range, executing from user-writable paths, and establishing the Run-key persistence the agent installs at HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. The Rust panic-handler source paths (src/views/zelcore/app.rs, src/views/trezor/seed_panel.rs, src/views/ledger/screens/seed_recovery.rs) are also surfaced via the binary's data section and are extremely high-fidelity if visible in any command-line or memory-scan telemetry. This rule pairs the persistence registration with the agent execution context.
Detects command-line obfuscation via Windows environment variable substring expansion (%var:~offset,length%), an evasion technique used by APT37 in the Operation Deepfake/HumanitarianBait-adjacent campaigns to reconstruct malicious commands at runtime and bypass static command-line scanning. This rule catches both the APT37-specific single-character extraction pattern (,1%) and the broader high-count substring-expansion pattern that any obfuscated command exhibits regardless of chunk size. It also flags cmd.exe /k invocation, which APT37 commonly uses.
Detects potential user namespace manipulation, a common precursor to kernel namespace exploits like Dirty Frag, by monitoring file modifications to uid_map and gid_map.
Page 11 of 92