Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,254 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects a specific COM hijacking technique used by the ForumTroll APT group for persistence. This rule identifies registry modifications to the CLSID {1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}, which the group has reused across campaigns.
Detects the use of Visual Studio Code (VSCode) tunnels for command and control (C2) or persistence. This technique, observed in use by threat actors like MUSTANG PANDA, leverages legitimate VSCode functionality to bypass network defenses.
Detects the deletion of the ':Zone.Identifier' Alternate Data Stream (ADS) from a file. This is a technique used by malware like Phorpiex to remove the Mark-of-the-Web and bypass security warnings on downloaded files.
Detects the setup for a Time-of-Check-to-Time-of-Use (TOCTOU) attack exploiting CVE-2025-64669 in Windows Admin Center. An attacker uses PowerShell with Register-WmiEvent to monitor for the WAC updater process, intending to perform a DLL hijack for privilege escalation.
Detects a browser hijacking technique where a WMI-driven script terminates a running browser process (Chrome or Edge) and immediately restarts it with malicious command-line arguments to load an unauthorized extension.
Detects modifications to the Windows Registry that disable critical security features, specifically related to Restricted Admin Mode, UAC remote token filtering, and DSRM logon behavior. Ink Dragon uses these modifications to facilitate lateral movement and maintain domain dominance.
Detects anomalous Okta sign-on policy evaluations originating from Cloudflare, which could indicate an Adversary-in-the-Middle (AiTM) phishing attempt. The associated campaign uses Cloudflare to host its phishing infrastructure.
Detects the silent installation and configuration of AnyDesk from the command line. This technique was observed being used by actors deploying DeadLock ransomware to establish persistence.
Detects outbound network connections from common web server processes to the Telegram API domain (api.telegram.org). This behavior is indicative of the BlackForce phishing kit exfiltrating stolen credentials, as newer versions use a server-side component to relay data to a Telegram channel.
This rule detects WebSocket C2 authentication attempts by the Frogblight mobile banking malware. It specifically looks for the hardcoded login key '{"login_key":"fg_a1b2c3d4e5f6"}' within TCP traffic destined for external networks.
Page 32 of 92