Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,222 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects high-fidelity static artifacts from VECT 2.0 across Windows, Linux, and ESXi variants. This includes known SHA-256 hashes of the ransomware executables, the '.vect' encrypted file extension, the '!!!READ_ME!!!.txt' ransom note, the 'dvm3_wall.bmp' wallpaper, the 'vector_notice.sh' shell hook, and the embedded Tor C2 hostname. These indicators are unique to VECT ransomware and have no legitimate use.
Detects PowerShell commands reading their own batch file contents via the %~f0 self-reference combined with .NET ReadAllText, the technique Deep#Door uses to extract its embedded Python payload from install_obf.bat without external network retrieval. The combination of these specific patterns has near-zero legitimate use.
Detects PowerShell command lines utilizing Invoke-WebRequest (or aliases) with a spoofed "ZoomSDK" User-Agent for payload delivery. This behavior is associated with BlueNoroff ClickFix campaigns targeting the Web3 sector.
Detects a Python process attempting to access the memory of another process via the /proc filesystem. This behavior was observed in the Shai-Hulud SAP CAP supply chain attack, where a Python script dumped the Runner.Worker process memory to extract short-lived, high-value tokens passed between CI workflow steps.
Detects modifications to the OpenClaw agent's SOUL.md file, which dictates the core behavior and instructions of the agent. Attackers exploit this by tampering with the file to persistently alter the agent's actions across all future sessions without needing traditional code execution, as seen in attacks against NVIDIA NemoClaw sandboxes.
Detects the execution of a Python interpreter (pythonw.exe) running the 'appclient' module from within the C:\ProgramData\Tailscale directory. This technique is used by the Silver Fox APT group to deploy the ABCDoor backdoor while masquerading as legitimate VPN software to evade detection.
Detects pip or pip3 installation commands targeting the specific compromised version of the elementary-data PyPI package. Installation of v0.23.3 indicates exposure to the supply chain compromise regardless of whether the marker file was subsequently observed. Also catches generic 'pip install elementary-data' without a version pin, which during the active window (2026-04-24 22:20 UTC to 2026-04-25 ~11:51 UTC) would have pulled the malicious version.
Detects the loading of known vulnerable drivers commonly abused in Bring Your Own Vulnerable Driver (BYOVD) attacks to bypass Driver Signature Enforcement (DSE) and gain Ring 0 execution.
Detects attempts to query, stop, or disable the legacy Interactive Services Detection (UI0Detect) service using the 'sc.exe' utility. This technique was observed in the Lotus Wiper destructive campaign to suppress interactive service graphical warnings before executing its wiper payload.
Detects the PowerShell 'Stop-VM -TurnOff' pattern used by Kyber ransomware's "experimental" Hyper-V functionality to force hard-stop all running VMs prior to encryption, releasing file locks on VHD/VHDX disks. This rule also includes an extended field 'IsEnumeration' to identify instances where 'Get-VM' and 'ConvertTo-Json' are used, which could indicate VM enumeration prior to termination.
Page 13 of 92