Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,222 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects PowerShell scripts attempting to overwrite the amsiContext buffer using Runtime.InteropServices.Marshal.WriteInt32 to disable AMSI scanning. This technique was notably observed in the InstallFix campaign delivering RedLine Stealer.
Detects the malformed User-Agent string used by CL-STA-1132 during exploitation
of CVE-2026-0300 (PAN-OS Captive Portal buffer overflow). The UA is structurally
invalid (Safari token precedes Mozilla token, Mozilla/5.5 is non-standard) and
has no known legitimate origin.
of CVE-2026-0300 (PAN-OS Captive Portal buffer overflow). The UA is structurally
invalid (Safari token precedes Mozilla token, Mozilla/5.5 is non-standard) and
has no known legitimate origin.
Detects pythonw.exe executing .pyw scripts from user-writable directories outside canonical Python installation paths. This execution pattern is used by Operation HumanitarianBait (module.pyw from %APPDATA%\WindowsHelper) and similar PyArmor-packed Python infostealer campaigns like PXA Stealer and JarkaStealer. These campaigns drop self-contained Python environments into vendor-mimicking AppData subdirectories. The rule catches the specific HumanitarianBait path/script combination and variants that alter the path or script name while maintaining the windowless-Python-from-AppData primitive.
Detects Node.js processes querying public IP-address and geolocation lookup services. This automated reconnaissance behavior is the standard "where am I" primitive used by an enormous range of Node-based malware and supply chain campaigns including PhantomRaven (npm), Shai-Hulud, the Bitwarden CLI compromise, Ultralytics-style attacks, and countless commodity Node-based stealers and droppers. Legitimate Node applications rarely query public IP services from developer endpoints — when they do, it is most often during malicious package install lifecycle hooks or within fileless droppers fetched from attacker-controlled C2 servers.
Detects the creation of a new MariaDB User-Defined Function (UDF) that loads a shared object (.so or .dll) file. This technique is used in the final stage of the CVE-2026-32710 attack chain to execute arbitrary OS commands, often from suspicious temporary or public directories.
Detects the initial staging phase of the CVE-2026-41940 exploit chain, where an attacker intentionally generates a pre-authentication session file on the target server via failed POST requests to the login_only endpoint.
Detects creation or modification of the SafeBoot\Network\Remote Access Service registry key, a persistence mechanism used by the STAC6405 (VENOMOUS#HELPER) campaign. This ensures the SimpleHelp-based RAT survives Safe Mode with Networking reboots, which is a common remediation step for defenders. The specific 'Remote Access Service' subkey under SafeBoot\Network is a static Indicator of Compromise (IOC) for this campaign, as modifications to SafeBoot\Network are generally rare in benign Windows operations.
Suspicious IIS Worker Child Process
Cortex XDR
Detects the IIS worker process (w3wp.exe) spawning anomalous or administrative child processes (e.g., rundll32.exe, csvde.exe, nltest.exe), indicative of post-exploitation web shell activity associated with SHADOW-EARTH-053.
Regasm Executing Text File Payload
Cortex XDR
Identifies regasm.exe executing a payload disguised as a .txt file. This technique is used by the CloudZ RAT dropper to execute its disguised .NET loader via a scheduled task while evading standard executable-based alerting. The rule specifically looks for 'regasm.exe' in the process image name and '.txt' in the command line, with additional specificity for '/nologo', 'update.txt', or 'msupdate.txt' to narrow down to known campaign indicators.
This rule detects the creation of files matching the exfiltration pattern used by the Mini Shai-Hulud malware. Specifically, it looks for files named 'results-<timestamp>-<counter>.json' within a 'results' directory, accounting for both Windows and Unix path separators. This pattern is indicative of data staging or exfiltration activities by the malware.
Page 12 of 92