Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,240 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects HTTP POST requests to n8n '/form/*' endpoints where the Content-Type header is 'application/json'. This indicates an attempt to exploit the Content-Type confusion vulnerability (CVE-2026-21858) to achieve arbitrary file read and subsequent remote code execution.
Detects a URL containing common redirection or proxy parameters where the value appears to be a ROT13 obfuscated URL, indicated by the presence of 'uggcf' ('https') and common ROT13'd TLDs. This is an evolution of a TTP observed in Kimsuky campaigns.
Detects phishing emails containing QR codes rendered using HTML tables. This technique is used to evade image-based scanning and OCR security controls by representing the QR code as a grid of small, colored table cells (<td>) instead of a traditional image file.
Detects the creation of a browser process in headless mode and in a suspended state. This technique is used by infostealers like AuraStealer to inject code into the browser process to bypass Application-Bound Encryption (ABE) and steal credentials.
Detects the ToddyCat APT group's technique of using PowerShell to connect to remote hosts via SMB admin shares (C$) and steal web browser credentials. This is associated with a variant of the TomBerBil tool and is particularly significant when observed originating from a domain controller.
Detects processes that masquerade as the 'init' process, a technique used by the GoBruteforcer malware. The rule identifies processes named 'init' while filtering out legitimate system init processes based on their process ID, parent process ID, and executable path.
Detects a specific command used by the Bulbature malware (associated with UAT-7290) to obtain the local network interface's name. This is part of its system reconnaissance routine.
Detects PowerShell making DNS requests for domains associated with less-reputable/uncommon TLDs. This behavior is not typical for legitimate administrative scripts and can indicate an attempt to download a payload from a malicious source.
Detects the creation of DLL files named with a GUID pattern in common staging directories. This technique was observed being used by the threat actor UKC-1230 to drop surrogate COM DLLs for persistence.
Detects the execution of the Mltab adware installer DLL, "OfficeTeam.Installer.dll", via rundll32.exe. This activity is part of a supply chain attack involving the Office Assistant software.
Page 28 of 92