Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,231 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects the execution of a piped command chain typical of 'ClickFix' lures used by the MacSync infostealer. The malware tricks users into pasting a command into the terminal which uses curl to download a payload, decodes it with base64, and pipes it directly into a shell (zsh, sh) or osascript for execution, bypassing macOS security controls like Gatekeeper.
Detects the execution of the Windows utility 'grpconv.exe' when it is spawned by a parent process located in a temporary or otherwise uncommon directory. This is an unusual parent-child relationship and is indicative of techniques like process hollowing used by malware such as the Evelyn Stealer's second-stage injector.
Detects the use of a command injection vulnerability in the legitimate Windows script 'SyncAppvPublishingServer.vbs' to execute arbitrary code. As seen in the ClearFake campaign, attackers can append a semicolon to the command-line arguments to execute subsequent malicious PowerShell commands.
Detects a Python process executing a binary from an in-memory file descriptor via the /proc filesystem. This technique was observed in the malicious 'sympy-dev' PyPI package, which used it to execute a cryptominer from memory, bypassing some file-based detections.
Detects attempts to exploit the SmarterMail authentication bypass vulnerability (WT-2026-0001) by sending a POST request to the /api/v1/auth/force-reset-password endpoint with 'IsSysAdmin' set to 'true'.
Detects the creation of a macOS Launch Agent by a suspicious process or with a name matching patterns used by the BlueNoroff group. BlueNoroff uses Launch Agents for persistence on compromised macOS systems.
Detects processes, other than legitimate web browsers or the official Telegram client, making DNS queries for the Telegram Bot API. This behavior is indicative of malware using Telegram for command-and-control (C2) or data exfiltration, as seen in a campaign leveraging Amnesia RAT.
Detects the execution of a PowerShell command that reads a file's byte stream and performs a XOR operation on it. This technique is used by the KONNI APT group to decrypt and execute an embedded payload in memory, as seen in their 2026 campaign involving AI-generated backdoors.
Detects the legitimate 'pdf24.exe' process loading 'cryptbase.dll' from a non-standard directory. This is indicative of a DLL side-loading attack, a technique used by the PDFSIDER malware to achieve execution and bypass security controls.
Detects ICMP Echo Request packets where the Identification field is set to the specific magic value 0xC0DE (49374). This value is used by the VoidLink rootkit as a trigger for its covert, out-of-band C2 channel, which can bypass standard firewall rules.
Page 25 of 92