Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,225 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects DNS queries for domains associated with an active adversary-in-the-middle (AiTM) phishing campaign targeting AWS credentials.
Detects the use of iptables to drop incoming SSH traffic (port 22). This is a tactic used by the KadNap malware via its 'fwr.sh' script to prevent administrative access and secure its foothold on an infected device.
Detects the execution of a scheduled task characteristic of the GhostWeaver RAT. The malware's persistence mechanism involves a hidden task that executes PowerShell via 'conhost --headless' and often uses a task name that mimics legitimate PowerShell cmdlets to blend in.
Detects DNS queries for subdomains of 'trycloudflare.com' originating from suspicious processes, such as script interpreters and LOLBins.
Attackers, such as those behind the VOID#GEIST campaign, leverage Cloudflare Tunnels to host command and control (C2) infrastructure, and initiating these connections from script interpreters or LOLBins is a common TTP.
Attackers, such as those behind the VOID#GEIST campaign, leverage Cloudflare Tunnels to host command and control (C2) infrastructure, and initiating these connections from script interpreters or LOLBins is a common TTP.
Correlates PowerShell extraction of specific files (steam_monitor, crashhandler, crashlog) with subsequent DLL side-loading where 'crashhandler.dll' is loaded by 'steam_monitor.exe' from a non-standard program or Steam directory, indicating a potential malware infection chain.
Detects the execution of legitimate Microsoft binaries, such as NGenTask.exe and phoneactivate.exe, from suspicious user-writable directories when the process has been renamed. This is a known TTP of the SloppyLemming threat actor for DLL sideloading.
Detects the JavaScript XOR-based string reconstruction pattern used by the Coruna iOS exploit kit. This pattern maps an array of integers through String.fromCharCode with XOR to reconstruct code at runtime. Coruna contained 23 iOS exploits targeting iOS 13.0 through 17.2.1 and was used by UNC6353 (Russian espionage) and UNC6691 (Chinese financially motivated).
Detects the complete CVE-2026-21902 exploitation chain against Juniper Junos OS Evolved On-Box Anomaly Detection Framework. Requires all four steps: command creation, DAG creation, DAG instance scheduling, and commit.
Detects a process running with a name that mimics a Linux kernel worker thread (e.g., 'kworker/...') but is not running as the root user. This is a known masquerading technique used by malware such as ClipXDaemon to evade detection.
Detects the creation of a 'WSPrint' scheduled task followed by deletion of its Security Descriptor (SD) registry value. Deleting the SD value hides the task from schtasks /query and Task Scheduler. This technique is used by UAT-9244 for stealthy persistence and is also associated with HAFNIUM/Tarrask.
Page 18 of 92