Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,222 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
etects the full TeamPCP lateral movement pattern: listing secrets across namespaces followed by privileged alpine pod creation in kube-system. Correlation rule.
Detects attempts to manually remove the Apple quarantine extended
attribute using the xattr utility. This technique is often used by malware,
such as the notnullOSX stealer, to bypass macOS Gatekeeper protections on
downloaded payloads.
attribute using the xattr utility. This technique is often used by malware,
such as the notnullOSX stealer, to bypass macOS Gatekeeper protections on
downloaded payloads.
Detects attempts to read raw disk data using mknod or dd, a technique observed in malicious npm packages to bypass permissions and extract secrets.
Detects instances where PowerShell spawns the fontdrvhost.exe process. This parent-child relationship is highly anomalous and is indicative of process injection, as seen in the final stage of the ClipBanker malware execution chain.
Detects the creation or modification of Exchange Online inbox rules, transport rules, or mailbox settings where the rule name consists exclusively of special characters. This pattern can be indicative of malicious activity, such as an attacker attempting to hide a forwarding rule or other automated action by using an obscure name.
Detects systemctl commands enabling or starting a service named 'sysupdate', which Canis C2 uses to masquerade as a legitimate system update process and maintain persistence on Linux systems. The service restarts every 30 seconds.
This rule detects the execution of PowerShell commands that utilize .NET's System.Drawing.Bitmap class and the .GetPixel method. This combination is indicative of steganography techniques being used to extract hidden data, often malicious payloads, from image files. This specific pattern has been associated with APT29.
Detects cmd.exe executing a batch script disguised with a .txt extension, a persistence technique used by SERPENTINE#CLOUD. The campaign delivers VenomRAT, AsyncRAT, XWorm/Violet, PureHVNC, and Brute Ratel C4 via ClickFix lures and Cloudflare tunnels.
Masqueraded wt.exe - Branch A: Impostor Binary Named wt.exe Detects a process with image name wt.exe whose OriginalFileName does NOT match wt.exe — i.e., a renamed binary masquerading as Windows Terminal.
Branch B: Legitimate wt.exe from Non-Standard Path Detects execution of a binary with OriginalFileName=wt.exe running from outside the expected Windows Terminal directories (WindowsApps).
Branch B: Legitimate wt.exe from Non-Standard Path Detects execution of a binary with OriginalFileName=wt.exe running from outside the expected Windows Terminal directories (WindowsApps).
Detects PowerShell execution that interacts with GitHub API or raw content endpoints and includes a GitHub Personal Access Token (PAT) in the command line. This combination can indicate malicious activity such as data exfiltration, code deployment, or C2 communication, especially if originating from an unexpected host or user.
Page 15 of 92