Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,222 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects the execution of a process named 'wt.exe' (Windows Terminal) from a non-standard directory, or deliberately renamed. This behavior is associated with the Axios npm supply chain attack, where the Windows RAT dropper copies 'powershell.exe' to '%PROGRAMDATA%\wt.exe' to masquerade its execution.
This rule detects attempts to exploit a vulnerability in ShareFile (CVE-2026-2699/CVE-2026-2701) by monitoring for HTTP GET requests to the `/ConfigService/api/StroageZoneConfig` URI path with a `h=` query parameter. This pattern is indicative of an attacker trying to leak API secrets.
Detects PowerShell queries against the root/SecurityCenter2 namespace to discover installed Antivirus products. This technique is often used by malware, such as EtherRAT's SYS_INFO module, to map defensive tooling and understand the security posture of a compromised system.
Detects the execution of `system_profiler` querying memory and hardware data types. Atomic Stealer (AMOS) utilizes these environmental awareness checks prior to execution to evade analysis by determining if it is running within a virtual machine environment.
Detects HTTP POST requests targeting the Langflow public flow build endpoint, which is vulnerable to unauthenticated Remote Code Execution (CVE-2026-33017).
Detects the specific OpenSSL command line arguments used by TeamPCP (Trivy compromise) to encrypt stolen credentials before exfiltration using a hybrid AES-256-CBC scheme. This rule looks for the 'openssl' executable being run with 'enc -aes-256-cbc' or 'enc -aes-256' and a passphrase specified via a file using '-pass file:'.
Detects authentication attempts utilizing a specific synthetic mobile user agent (iOS 18 paired with Safari Version/26.x) observed in the EvilTokens device code phishing campaign. Version 26 does not exist on iOS 18.
This rule detects attempts to establish persistence by modifying the Windows Registry 'Run' key to execute 'conhost.exe' in headless mode. This technique is often used by adversaries to maintain access and execute malicious payloads upon user login, while attempting to hide the execution by using a legitimate Windows binary in a less common mode.
Detects malicious DLLs masquerading as libcurl.dll by identifying a low number of curl_easy_* exports combined with BRUSHLOGGER keylogger string artifacts. Designed to catch DLL side-loading attempts.
Detects non-standard processes (e.g., command shells, script hosts) loading WinRT notification and push app libraries (wpnapps.dll, notificationcontroller.dll), which may indicate an implant or script attempting to send spoofed toast notifications for social engineering.
Page 16 of 92