Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,244 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects PowerShell commands that utilize string normalization obfuscation techniques before Base64 decoding. This rule identifies a generic pattern where one or two placeholder characters are replaced with a literal character, a technique used by malware like SHADOW#REACTOR to bypass static string analysis of the encoded payload.
Detects MuddyWater Rust-based implants containing unstripped build artifacts, specifically the username 'Jacob' and other development environment paths.
Detects when a Python process spawns a shell or a network utility. This behavior can be indicative of Remote Code Execution (RCE) vulnerabilities being exploited in AI/ML libraries (e.g., CVE-2025-23304, CVE-2026-22584) that allow attackers to execute arbitrary code when a malicious model file is loaded.
Detects a sequence of events associated with the Astaroth banking trojan, where a script downloads a file from a raw GitHub URL, followed by the execution of an AutoIT interpreter. Astaroth is known to use GitHub to host configuration files disguised as images (steganography).
Detects when the Landlock Linux Security Module (LSM) denies an access request from a sandboxed application. This indicates that a process is attempting to perform an action that violates its predefined security policy, which can be a sign of misconfiguration or malicious activity such as exploitation.
Detects the injection of a malicious iframe with attributes that impersonate the legitimate Stripe payment interface. This technique is used by Magecart actors to steal credit card data by replacing the real payment form with a clone.
Detects outbound network traffic with a User-Agent header indicating the use of the Rust 'reqwest' HTTP client library. This User-Agent is used by the RustyWater implant, associated with the MuddyWater APT group, for command and control (C2) communications.
Detects the use of the Microsoft Device Console (devcon.exe) to disable VMware Virtual Machine Communication Interface (VMCI) devices. This is a preparatory step observed in the 'MAESTRO' toolkit to gain exclusive hardware access before loading a malicious driver for a VM escape exploit.
Detects pkr_mtsi packer samples based on their characteristic use of junk GDI API calls for obfuscation. The rule looks for PE files that import an excessive number of GDI32.dll functions and contain repeated calls to CreateSolidBrush with random color values.
Detects specific User-Agent strings associated with the DDoSia malware, which is used by the NoName057(16) hacktivist group for DDoS attacks. The rule looks for two distinct User-Agent patterns in HTTP traffic.
Page 27 of 92