Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,225 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects command line executions from non-standard applications attempting to query the local Azure Arc metadata endpoints (ports 40341/40342), which may indicate an attacker enumerating or exploiting the HIMDS token service (CVE-2026-26117).
Detects HTTP POST requests targeting the Langflow public flow build endpoint, which is vulnerable to unauthenticated Remote Code Execution (CVE-2026-33017).
Detects the execution of a binary from the path /tmp/pglog, which is used as a
dropper location by the malicious sysmon.py script associated with the TeamPCP
Trivy supply chain malware.
dropper location by the malicious sysmon.py script associated with the TeamPCP
Trivy supply chain malware.
Detects DNS queries to Solana RPC endpoints associated with GlassWorm/ForceMemo blockchain-based C2. The malware queries up to 9 Solana RPC endpoints to retrieve C2 instructions from on-chain transaction memos. A Python process resolving any of these domains is anomalous outside of cryptocurrency development environments.
Detects potential exploitation of the RegPwn privilege escalation vulnerability (CVE-2026-24291).
The exploit involves creating a registry symbolic link in a user-writable accessibility configuration path that is later accessed by a SYSTEM process.
This allows an attacker to write to an arbitrary registry location as SYSTEM. This rule detects the creation of the malicious registry symlink, the payload execution where osk.exe modifies a service, and the command-line arguments of the public proof-of-concept tool.
The exploit involves creating a registry symbolic link in a user-writable accessibility configuration path that is later accessed by a SYSTEM process.
This allows an attacker to write to an arbitrary registry location as SYSTEM. This rule detects the creation of the malicious registry symlink, the payload execution where osk.exe modifies a service, and the command-line arguments of the public proof-of-concept tool.
High-fidelity correlation detecting DPRK Contagious Trader npm malware persistence: Node.js process modifying authorized_keys followed by ufw allowing SSH. Targets cryptocurrency traders via poisoned GitHub trading bot repositories.
Detects HTTP/HTTPS traffic where the User-Agent string is explicitly set to 'MicroStealer/1.0', which is used by the malware when communicating with Discord webhooks or its C2.
Detects the Cursor IDE process spawning shell interpreters or
network utilities. This behavior is associated with the CursorJack technique,
where a malicious Model Context Protocol (MCP) server configuration executes
commands for initial access or payload staging.
network utilities. This behavior is associated with the CursorJack technique,
where a malicious Model Context Protocol (MCP) server configuration executes
commands for initial access or payload staging.
Detects Node.js or Python processes executing highly obfuscated or large inline expressions via the '-e' (Node.js) or '-c' (Python) flags. This technique is a primary execution method for stagers associated with North Korean APTs, such as DEV#POPPER and OmniStealer, which are often hidden in legitimate-looking configuration files.
Detects BigQuery queries using CONCAT with CHR functions to dynamically build cross-project paths, bypassing dot filters. High-fidelity indicator of LeakyLooker-style SQL injection.
Page 17 of 92