Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,244 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects the execution of the `iwpriv` utility by an unprivileged user targeting subcommands that are vulnerable to Local Privilege Escalation (LPE) in certain MediaTek Wi-Fi drivers. The exploitation of these vulnerabilities is demonstrated to be possible by unprivileged users, making the execution of kernel-level configuration tools like `iwpriv` by non-root users a highly suspicious activity.
Identifies JSON Web Tokens (JWTs) where the signing algorithm in the header ('alg') is set to 'none'. A server that incorrectly trusts this header may skip signature validation, allowing an attacker to create arbitrary tokens and bypass authentication controls.
Detects a successful SSO administrative login followed by a system configuration download from the same user and source IP address within 5 minutes. This sequence is a strong indicator of compromise related to CVE-2025-59718 and CVE-2025-59719.
Detects when legitimate .NET utilities, often abused for process hollowing, make outbound network connections. This is anomalous behavior and may indicate that the process has been injected with malicious code to bypass defenses.
Detects PNG files containing a steganographic marker ('===') used by the GhostPoster malware campaign to hide a JavaScript payload. This technique was observed in malicious Firefox browser extensions.
Detects the legitimate Windows utility MSBuild.exe initiating any outbound network connections. MSBuild.exe is a software build tool and should not typically make network connections outside of development environments. This behavior is highly indicative of process hollowing, where malware injects itself into the MSBuild process to evade defenses, as seen in recent BlindEagle campaigns.
Detects the creation or modification of the '/tmp/sslvpn.log' file, a known artifact of a new Linux variant of the Lazarus BADCALL backdoor.
Detects Microsoft Excel spawning an executable in a typical malware staging directory directory. This behavior is a strong indicator of a malicious XLL loader used by the Paper Werewolf (GOFFEE) group to drop the EchoGather backdoor.
Detects the execution of Node.js with the '-e' flag, which evaluates a string as JavaScript. This technique is used by the EtherRAT implant for fileless execution, particularly for privilege escalation attempts.
Detects the disabling of the VMware ESXi firewall using 'esxcli', a technique used by the RansomHouse 'MrAgent' tool as a defense evasion tactic before encryption.
Page 31 of 92