Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,225 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects the execution of a command pattern commonly associated with "ClickFix" social engineering attacks. This technique tricks users into pasting a command into their terminal, which typically uses 'echo' to pass a base64 encoded string to the 'base64' utility for decoding, and then pipes the output to a shell for execution. This method is used to bypass traditional OS-level protections like Gatekeeper and Notarization.
Detects behavioral indicators associated with a malware campaign distributing a credential and crypto-wallet stealer disguised as a Windows 11 update. Detection is based on TTPs rather than IOCs for longevity: suspicious directory creation, obfuscated PowerShell execution, and registry-based persistence.
Detects incoming emails from Atlassian Jira domains (atlassian.net) that contain suspicious link redirectors or known Traffic Distribution Systems (TDS) like Keitaro. This activity is associated with a campaign where threat actors abuse Jira's trusted domain to send spam and phishing emails.
Detects outgoing network connections using the User-Agent 'ArkanixStealer/1.0', which is hardcoded in the C++ variant of the Arkanix Stealer.
Detects the execution of iptables commands used for Single Packet Authorization (SPA), a technique observed being used by UNC6201. This rule identifies when iptables is configured to inspect traffic on port 443 for a specific hex string, which is a key component of the actor's C2 proxying tradecraft.
Detects the use of 'icacls.exe' to grant 'Full Control' permissions to 'Everyone' on directories used by JWrapper and the SimpleHelp RMM tool. This behavior was observed in campaigns where threat actors use JWrapper to package and deliver the SimpleHelp RAT, and this command ensures the malware has unrestricted access to its installation folders.
Detects the creation of files with a .sys extension in the C:\Windows\System32\drivers\ directory that are actually portable executables (DLLs/EXEs). This is a staging technique used by the REF4033 group to deploy the BADIIS malware.
Detects the execution of a SimpleHelp RMM executable from a non-standard file path. This behavior is associated with threat actors establishing persistence after exploiting vulnerabilities like CVE-2026-1731 in BeyondTrust appliances.
Detects Chromium-based browsers (e.g., Microsoft Edge, Google Chrome) being launched with specific command-line arguments that attempt to hide the browser window (headless mode or positioning it off-screen).
This technique was observed in the "Operation MacroMaze" campaign, attributed to APT28, where it was used to silently execute scripts and exfiltrate data using legitimate services like webhook.site.
This technique was observed in the "Operation MacroMaze" campaign, attributed to APT28, where it was used to silently execute scripts and exfiltrate data using legitimate services like webhook.site.
Detects when a VM Run Command is executed successfully, followed by the VM's Managed Identity authenticating to Azure Resource Manager. This pattern may indicate an attacker using Run Command to steal MI tokens for lateral movement.
Page 20 of 92