Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,254 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects network connections to Discord webhook URLs from non-standard processes. This technique is often used by malware, such as Phantom Stealer, to exfiltrate stolen data.
This rule detects Command and Control (C2) communication associated with the Mythic C2 framework utilizing Server Message Block (SMB) for peer-to-peer (P2P) beaconing. It specifically looks for SMB_COM_WRITE_ANDX commands with a data size greater than 360 bytes, containing a specific null byte pattern at offset 86, and a PCRE match for a GUID-like string, which are indicators of Mythic C2 SMB P2P beacon traffic.
Detects privilege escalation attempts used by the Shai-Hulud malware. This includes checking for passwordless sudo ('sudo -n true') and exploiting Docker to modify the 'sudoers.d' file to grant root privileges.
Detects the PeerBlight Linux backdoor masquerading as the '[ksoftirqd]' kernel thread. This is a defense evasion technique used by the malware to blend in with legitimate system processes.
Detects PowerShell being used with an encoded command that contains download and execution primitives. This is a common technique used by adversaries, including in the exploitation of CVE-2025-55182 (React2Shell), to download and run second-stage payloads in memory.
Detects React2Shell exploitation attempts via prototype pollution and Node.js
gadget invocation. Covers vulnerability scanning, gadget testing, and active
RCE exploitation.
gadget invocation. Covers vulnerability scanning, gadget testing, and active
RCE exploitation.
This rule detects command and control (C2) beaconing activity associated with the SHADOW-VOID-042 malware family. Specifically, it looks for HTTP POST requests containing the string "get_module_hello" in the request body, which is indicative of a C2 communication pattern used by this malware.
Detects a sequence of commands used by 01flip ransomware to delete itself from a Windows host after encryption. This involves using fsutil to zero out the file, and using the del command to delete it.
Detects multiple WMI or PowerShell commands used by a Lumma Stealer loader to perform anti-VM and anti-sandbox checks. This includes querying for video controller details, refresh rates, and disk drive models.
Detects the creation of malicious DLL files used for side-loading by the Ashen Lepus group's AshTag malware suite. These DLLs are often dropped in non-standard locations to be loaded by legitimate executables.
Page 33 of 92