Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,231 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects the IIS worker process (w3wp.exe) spawning a command-line interpreter or reconnaissance tool. This is a common behavior of web shells and in-memory backdoors like IIServerCore, which is part of the NET-STAR malware suite used by the Phantom Taurus APT group.
Detects PowerShell processes spawned by Visual Studio Code or Cursor IDEs that use suspicious flags like '-WindowStyle Hidden' and commands typical of download cradles. This behavior is associated with malicious extensions that execute second-stage payloads.
Detects attempts to exploit the Apache bRPC heap profiler command injection vulnerability, CVE-2025-60021. This is done by monitoring for HTTP GET requests to the `/pprof/heap` endpoint where the `extra_options` parameter contains shell metacharacters indicative of an RCE attempt.
Detects a Python process, potentially renamed, injecting code into the InstallUtil.exe utility. This behavior is a known TTP used by a Vietnamese threat actor in PureRAT campaigns, where a Python loader fetches a payload and injects it into a legitimate .NET utility to execute shellcode and evade defenses.
Detects network connections to the GitHub API attempting to fetch a 'command.txt' file. This behavior is characteristic of the GITSHELLPAD backdoor, which uses private GitHub repositories for command and control (C2) communication as seen in the Gopher Strike campaign.
Detects when the Windows Admin Center service ('SmeSvc.exe') is stopped, and shortly thereafter, a different process starts listening on the WAC port (TCP/6516). This behavior is a key indicator of CVE-2026-20965 exploitation, where an attacker impersonates the service to steal administrator access tokens.
Detects the execution of Node.js (node.exe) when spawned by PowerShell or the Command Prompt from a user-writable directory. This behavior is characteristic of the Tsundere Bot delivery chain used by threat actors like TA584 (Storm-0900), who use a PowerShell script to install and run the Node.js-based malware.
Detects the SmarterMail service process ('MailService.exe') spawning command-line interpreters to execute reconnaissance commands. This behavior is highly indicative of remote code execution following the exploitation of vulnerabilities like CVE-2026-23760.
Detects the legitimate Adobe binary 'ADNotificationManager.exe' loading 'urlmon.dll' from a non-system directory. This is a DLL Sideloading technique (T1574.002) used by a Vietnamese Stealer campaign for initial execution.
Detects attempts to exploit an authentication bypass vulnerability in the Inetutils Telnet daemon. Attackers inject the '-f' flag into the 'USER' environment variable during Telnet negotiation to gain unauthorized shell access.
Page 24 of 92