Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,244 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects instances where a ScreenConnect client or installer process is spawned by a web browser or email client. This behavior is indicative of a social engineering attack where a user is tricked into downloading and executing a rogue Remote Monitoring and Management (RMM) tool.
Detects the termination of Discord processes or a restart using Update.exe with the '--processStart' argument. This behavior is characteristic of the VVS Stealer, which uses this technique to inject malicious JavaScript for session hijacking.
Detects malicious browser extensions associated with the DarkSpectre 'Zoom Stealer' campaign by identifying known malicious extension IDs. The campaign uses these extensions for corporate espionage by stealing meeting intelligence from various video conferencing platforms.
Detects an attempt to disable .NET deserialization safeguards by modifying the 'disableActivitySurrogateSelectorTypeCheck' field. This technique was observed in an APT36 campaign where it was used to prepare the environment for the in-memory execution of a malicious DLL via unsafe deserialization.
Detects the tampering of the Microsoft Defender file system mini-filter driver's 'Altitude' registry value. The HoneyMyte APT's rootkit sets this value to '0' to prevent the driver from loading, effectively impairing system defenses.
Detects command injection attempts in HTTP POST requests targeting IoT device web interfaces, a technique used by the RondoDoX botnet to compromise vulnerable devices.
Detects the creation or modification of registry values used by the Valley RAT malware to store its configuration and modular plugins. Silver Fox operators use this mechanism for persistence and to dynamically update C2 infrastructure.
This rule detects patterns indicative of an Evilginx-style Adversary-in-the-Middle (AiTM) phishing attack. It specifically looks for HTTP requests to hostnames ending in suspicious top-level domains (TLDs) such as .click, .online, .cloud, or .shop, combined with specific URI paths like /wlc/, /load/, or /success/. These patterns are commonly used by AiTM redirectors to capture credentials and session tokens.
Detects HTTP POST requests containing WDDX XML payloads that attempt to exploit a deserialization vulnerability in Adobe ColdFusion (CVE-2023-26359). The attack leverages a JNDI injection with the 'com.sun.rowset.JdbcRowSetImpl' gadget chain.
Detects the installation of malicious npm packages associated with the Shai-Hulud 2.0 supply chain attack campaign.
Page 29 of 92