Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,254 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects the use of certutil.exe to decode a payload from a file with a misleading extension (e.g., .png) and save it as a DLL in a suspicious location. This technique was observed in the 'Operation Hanoi Thief' campaign.
Detects a User Account Control (UAC) bypass attempt using the ICMLuaUtil elevated COM interface. This technique has been observed in use by the Silver Fox APT group to escalate privileges.
Detects the creation of a new domain user account that is immediately added to a high-privilege group, such as Domain Admins. This pattern is a strong indicator of persistence and privilege escalation, as observed in the Lynx Ransomware campaign.
Detects the PREYHUNTER 'watcher' module performing anti-analysis checks by launching common security, forensic, or shell tools.
This rule detects potential Browser-in-the-Browser (BITB) phishing attacks, specifically targeting the 'Sneaky2FA' technique. It looks for HTTP responses containing an iframe, base64 encoded image data, and the string ';base64,', which are indicators of a malicious page attempting to mimic a legitimate login portal within an iframe to steal credentials.
Detects the creation of a named pipe with the format `\.\pipe\dll-%hex_encoded_PID%`. This behavior is associated with the Matanbuchus malware, which uses this technique to inject a DLL payload into a remote msiexec.exe process.
Detects HTTP requests targeting the Oracle Identity Manager REST API that contain known authentication bypass suffixes, such as `?WSDL` or `;.wadl`. This indicates an attempt to exploit the initial authentication bypass stage of the CVE-2025-61757 exploit chain.
Detects the creation of a project-local OpenAI Codex configuration file (`.codex/config.toml`) followed by the execution of the `codex` CLI from the same directory. This pattern is indicative of an attempt to exploit CVE-2025-61260, a command injection vulnerability that allows for arbitrary code execution.
This rule detects HTTP GET requests containing specific URL patterns associated with Calisto phishing campaigns. The patterns include '/vendor/plugx/', '/wp-content/plugins/(bungs|areada|leykos)/', '/prueba/phantomrise/', or '/plugins/unite/', combined with the 'utm_refferer=' parameter in the URI. This indicates an attempt to redirect users to malicious content, likely as part of a phishing attack.
Detects the DUPERUNNER implant injecting shellcode into common legitimate Windows processes like explorer.exe, notepad.exe, or msedge.exe. This behavior is associated with the UNG0902 threat actor as part of the Operation DupeHike campaign.
Page 35 of 92