Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,225 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects the full FakeGit infection chain: CMD/BAT launcher spawning LuaJIT with malicious payload argument.
Detects HTTP POST requests to the SolarWinds Web Help Desk (WHD) AjaxProxy endpoint that contain hex-encoded JSON keys or values (e.g., `\xNN`).
Attackers use this technique to bypass security filters and achieve remote code execution, as detailed in the exploit chain for CVE-2025-40552 and CVE-2025-40553.
Attackers use this technique to bypass security filters and achieve remote code execution, as detailed in the exploit chain for CVE-2025-40552 and CVE-2025-40553.
Detects the creation of a new Windows service where the binary path points to suspicious, world-writable, or temporary directories. This is a common technique used in Bring Your Own Vulnerable Driver (BYOVD) attacks to load a malicious or vulnerable driver.
Detects the creation or modification of Python scripts in the /unitree/etc/programming/ directory on Unitree Go2 robots. This activity is a strong indicator of exploitation of CVE-2026-27509 or CVE-2026-27510, where an attacker uploads a malicious script for remote code execution.
Detects the execution of legitimate Windows binaries from non-standard public or program data directories. This technique is used by the Dohdoor malware to sideload a malicious DLL.
Detects the Claude CLI or Claude Code spawning suspicious child processes such as shells or network utilities. This behavior indicates exploitation of malicious hooks or MCP server configurations executing arbitrary commands, as seen in CVE-2025-59536 and CVE-2026-21852.
Detects the execution of the .NET compiler utility 'Aspnet_compiler.exe' by a scripting engine like PowerShell or JScript/VBScript. This behavior is highly unusual and is a known technique used by malware like Agent Tesla to perform process hollowing, where the legitimate 'Aspnet_compiler.exe' process is hollowed out and injected with malicious code.
Detects the execution of osascript to display a deceptive dialog box mimicking 'System Preferences' to harvest user passwords. This technique was observed being used by the Atomic Stealer (AMOS) malware.
Detects the execution of "rundll32.exe" without any command-line arguments. This is highly unusual behavior, as "rundll32.exe" is intended to load and run functions from DLLs, which requires specifying a DLL path in the command line. This technique is used by malware like ValleyRAT (as part of the Winos4.0 framework) to inject modular plugins into memory.
Detects HTTP requests to vulnerable Ivanti EPMM endpoints containing URI patterns associated with active exploitation of CVE-2026-1281 and CVE-2026-1340. The rule looks for specific URI paths and the presence of a 'gPath' parameter, which is indicative of an exploitation attempt.
Page 19 of 92