Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,254 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects emails containing URLs with patterns characteristic of the Tycoon 2FA phishing kit. These URLs often contain a base64-encoded email address in the path, preceded by a special character.
Detects a network connection to an external SMB or WebDAV server immediately following the launch of a .url file. This behavior is associated with CVE-2024-43451, where threat actors use malicious .url files to leak NTLM hashes.
Detects the execution of mshta.exe with a URL containing a hex-encoded second octet in an IP address. This is a specific pattern observed in the initial access stage of the ClickFix malware campaign.
Detects the RomCom loader 'msedge.dll' being loaded from a location outside of the legitimate Microsoft Edge installation directory. This is a known TTP for the RomCom threat group to load their Mythic Agent, often as a result of COM hijacking.
Detects the creation of files with double extensions (e.g., .pdf.rar, .txt.exe), a technique used by the Water Gamayun APT group to disguise malicious payloads.
Detects the creation of a Windows service with a suspicious name or an executable path in an unusual location, a technique used by APT41 for persistence.
Detects HTTP requests attempting to exploit several IoT device vulnerabilities leveraged by the ShadowV2 botnet to spread. This rule looks for specific URI paths and command injection payloads associated with known CVEs.
Detects the Kimsuky TTP of using legitimate cloud services like GitHub and Google Drive to download and subsequently execute malicious payloads, often using interpreters like mshta.exe or rundll32.exe.
Detects the execution of a malicious JAR file, a technique used by the Bloody Wolf APT group to download and execute NetSupport RAT components.
Detects a potential BADAUDIO DLL Sideloading persistence attempt, a technique used by APT24. The rule looks for the creation of a DLL, an executable, and a script/shortcut file (VBS, BAT, LNK) in a common user directory within a short time frame.
Page 36 of 92