Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,231 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects the suspicious spawning of UserAccountBroker.exe by explorer.exe, which is then observed making an outbound network connection. This behavior is characteristic of a watchdog mechanism used by the ValleyRAT malware to maintain persistence and C2 communication.
Detects persistence mechanisms used by the OtterCookie malware, part of the Lazarus "Contagious Interview" campaign. It specifically looks for the creation of a 'NodeHelper' registry run key and a 'NodeUpdate' scheduled task.
Detects the multi-stage DEAD#VAX infection chain by correlating the creation of a specific batch file artifact with subsequent execution, persistence, or process injection activities.
Detects the execution of a process named 'code.exe' or 'lightshot.exe' from a temporary directory.
This behavior was observed in a campaign involving a malicious VS Code extension, "ClawdBot Agent", which impersonates a legitimate AI coding assistant.
The extension drops and executes a weaponized ScreenConnect payload, masquerading it as a legitimate VS Code or Lightshot process to evade detection.
The execution is often spawned by the legitimate VS Code process.
This behavior was observed in a campaign involving a malicious VS Code extension, "ClawdBot Agent", which impersonates a legitimate AI coding assistant.
The extension drops and executes a weaponized ScreenConnect payload, masquerading it as a legitimate VS Code or Lightshot process to evade detection.
The execution is often spawned by the legitimate VS Code process.
Detects the Quest Desktop Authority agent service spawning suspicious child processes. This activity could be an indication of exploitation of CVE-2025-67813, where an attacker leverages the 'AdminExec' operation to achieve remote code execution as SYSTEM.
Detects the use of the finger.exe utility to download remote data and pipe it directly into a command interpreter for execution. This LOLBin technique is used by threat actors like KongTuke to download and execute subsequent stages.
Detects Sysmon Image Load events for shdocvw.dll or ieframe.dll by Office applications, which indicates the Shell.Explorer.1 or Internet Explorer component is being loaded. This is a direct indicator of CVE-2026-21509 exploitation as Office normally doesn't load these browser-related DLLs. The vulnerability specifically exploits the Shell.Explorer.1 COM object which relies on these DLLs for browser functionality within Office documents.
Detects network connections initiated by Microsoft Office applications that may indicate CVE-2026-21509 exploitation. The Shell.Explorer.1 embedded browser component can establish outbound connections to attacker-controlled servers without user awareness. This rule monitors for Office processes making HTTP/HTTPS connections, especially to non-Microsoft and non-CDN destinations.
Detects the creation of hidden local user accounts (`admin$`, `mysql$`, `mssql$`, `admin1$`, `admin2$`, `power$`) using `net.exe` or `net1.exe` as used by the threat actor UAT-8099 for persistence on compromised IIS servers. The rule also broadly detects any account creation ending with a '$' symbol, which often indicates a hidden account.
Detects the use of GDB (GNU Debugger) to dump the memory of a running process. This technique is used by frameworks like ShadowHS to extract credentials and other secrets from live processes without writing traditional credential dumping tools to disk.
Page 23 of 92