Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,231 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects the execution of a Python interpreter (python.exe or pythonw.exe), potentially renamed, from a non-standard, user-writable location.
This can be an indicator of a threat actor dropping a portable Python environment to execute malicious scripts, as seen in campaigns like AsyncRAT.
This can be an indicator of a threat actor dropping a portable Python environment to execute malicious scripts, as seen in campaigns like AsyncRAT.
Detects cscript.exe executing a JScript file using a legacy NTFS 8.3 shortname. This is a known technique used by Gootloader during its persistence phase to obfuscate the script's path and name.
Detects HTTP POST requests to the Appsmith password reset endpoint where the 'Origin' header does not match the expected internal or legitimate application domain. This is indicative of an attempt to exploit CVE-2026-22794 to achieve account takeover.
Detects the creation or modification of a Windows service to belong to a high-priority service group.
Adversaries may use this technique, as seen with the EDRStartupHinder tool, to ensure their malicious service runs before security products, allowing them to disable or tamper with EDR/AV solutions before they can initialize.
Adversaries may use this technique, as seen with the EDRStartupHinder tool, to ensure their malicious service runs before security products, allowing them to disable or tamper with EDR/AV solutions before they can initialize.
Detects the use of PowerShell to add exclusions to Windows Defender. This technique was observed in the PHALT#BLYX campaign where attackers added exclusions for the 'C:\ProgramData' directory and for file extensions like '.exe', '.ps1', and '.proj' to prevent their malware from being detected.
Detects attempts to exploit the ServiceNow 'BodySnatcher' vulnerability (CVE-2025-12420) by invoking the internal 'AIA-Agent Invoker AutoChat' topic to execute arbitrary AI agents.
Detects a PowerShell process that makes an outbound network connection and contains command-line arguments associated with reflectively loading a .NET assembly from a Base64 encoded string. This is a common fileless technique used by malware like Remcos to execute payloads in memory.
Detects the creation and execution of anonymous memory-backed files using `memfd_create`. This technique is used by malware like VoidLink to execute modular plugins or payloads directly in memory, bypassing disk-based detection mechanisms.
Detects the DLL sideloading of the Kazuar v3 loader (hpbprndiLOC.dll) by a legitimate Hewlett-Packard printer driver installer (hpbprndi.exe). This technique is used by Turla to initiate its infection chain.
Detects the SHADOW#REACTOR process execution chain of wscript.exe spawning powershell.exe, which in turn spawns MSBuild.exe.
Page 26 of 92