Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,227 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects Okta MFA device enrollment or life cycle changes that occur shortly after a successful authentication or password reset for the same user. This pattern is a strong indicator of a post-vishing account takeover, as seen in ShinyHunters campaigns.
Detects Bash /dev/tcp with HTTP request construction - high fidelity detection for payload download via raw sockets
Detects when a user authorizes the 'ToogleBox Recall' Google Workspace add-on. This tool has been observed being used by threat actors like UNC6661 (associated with ShinyHunters) to automate the deletion of MFA enrollment notifications, hiding unauthorized device registrations.
Detects DKnife attempting to discover network information by sending a POST request with a specific password hash to a router management interface. This activity is associated with the DKnife framework, a China-nexus gateway-monitoring tool.
Detects a command line pattern where `curl` is used to download a payload, which is then piped to `base64` for decoding and `gunzip` for decompression. This technique is commonly used by macOS infostealers like DigitStealer and MacSync to execute malware in memory without writing it to disk.
Detects attempts to exploit a vulnerability in Google Looker (CVE-2025-12743) by using error-based SQL injection within LookML dimension definitions. Attackers can use this to exfiltrate the internal Looker database.
Detects the execution of a command shell by the Java Runtime to run a batch file from a typical malware staging directory. This behavior is a core TTP of the Stan Ghouls group, used to execute their malicious Java-based loaders which in turn drop and run the NetSupport RAT.
Detects WinGUp (gup.exe) making network connections to domains other than the legitimate Notepad++ update infrastructure. Per Kevin Beaumont, gup.exe should only connect to notepad-plus-plus.org, github.com, and release-assets.githubusercontent.com.
Detects the use of the Windows Management Instrumentation Command-line (WMIC) utility to add an exclusion (Path, Process, or Extension) to Microsoft Defender. This technique is used by malware, such as the MKDOOR backdoor, to prevent detection by security products.
Detects the use of the 'Add-Type' cmdlet in PowerShell to compile and load C# code directly into memory. This technique is used by the TAMECAT backdoor to pivot from PowerShell to C# modules for tasks like exfiltration and browser data theft, bypassing file-on-disk scanning.
Page 22 of 92