Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,243 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects suspicious email inbox rule creation indicative of account compromise. Focuses on rules with randomly-generated names or rules that move emails to low-visibility folders combined with hiding actions (mark as read, delete, stop processing).
Detects the execution of a batch file from a common user directory (e.g., Downloads, Desktop) that immediately launches an executable file. This pattern was observed in a Webrat malware campaign where a `start_exp.bat` file was used to launch the primary malicious payload, `rasmanesc.exe`, tricking users into running it after extracting a fake exploit archive.
Detects the DLL sideloading technique used by the Evasive Panda APT group, where the legitimate and signed 'evteng.exe' executable is used to load the malicious 'libpython2.4.dll'.
Detects the use of attrib.exe to set system (+s) and hidden (+h) attributes on an executable file in a suspicious folder. This technique was observed being used by threat actors to hide payloads like SparkRAT.
Detects the loading of a vulnerable version of WindowsCodecs.dll (related to CVE-2025-50165) by non-standard applications. This could indicate an attempt to exploit the vulnerability in a custom or unexpected application context.
Detects the DriverFixer0428 macOS credential stealer, attributed to the North Korean 'Contagious Interview' campaign. This rule identifies the malware based on unique internal strings, network IOCs related to Dropbox exfiltration, and social engineering text.
Detects the creation of a Windows service named "NSecRTS" with the display name "Windows Real-time Protection Service" and an executable path in a suspicious "NSEC" folder. This behavior is associated with a China-linked RAT observed in an Indian Income Tax-themed phishing campaign.
Detects a specific DLL side-loading pattern used by APT37 in the 'Operation Artemis' campaign. A legitimate Sysinternals utility (e.g., 'mhelp.exe', 'vhelp.exe', 'Volumeid1.exe') is executed from a suspicious directory and loads a malicious 'version.dll' from the same path.
Detects the creation of systemd services used by the PCPcat malware for persistence on Linux systems.
Detects successful Microsoft 365 sign-ins using the OAuth 2.0 device code grant flow for applications with low prevalence. This technique is used by threat actors to gain unauthorized access to accounts, bypassing some MFA controls.
Page 30 of 92