Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,214 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects DLL sideloading across the SilkParasite campaign's five signed/trusted host binaries: MpDefenderCoreService.exe loading mpclient.dll (DriveSilkRAT), ebook-edit.exe loading calibre-launcher.dll (SpiceRAT), Mp3tag.exe loading tak_deco_lib.dll (CookiETagRAT), FineReader.exe loading dsp_ippv2_x64.dll (BloodAlchemy), and Acrobatlog.exe loading scansts.dll (NomadRAT).
KQL Query from file: T1546.003: WMI Realtek-named EventFilter/Consumer Triggers RtkNGUI64.exe Backdoor
Detects Python worker processes (e.g., dataset converters) spawning suspicious child processes (shells, network tools) or accessing sensitive filesystem paths/endpoints, such as Kubernetes service account tokens or cloud instance metadata, which are often indicative of post-exploitation activity following an SSTI or code injection vulnerability.
Detects the execution of known remote monitoring and management (RMM) or remote access tools shortly after Microsoft Teams process activity on a host. This behavior is consistent with helpdesk-impersonation vishing attacks where an adversary convinces a user to initiate a remote session.
Detects potential post-exploitation activity originating from the SharePoint worker process (w3wp.exe). The rule monitors for three primary indicators: w3wp.exe spawning command interpreters (cmd.exe or powershell.exe), unauthorized file modifications or creations within SharePoint web directories, and outbound network connections to public IP addresses initiated by w3wp.exe, which may indicate payload delivery or C2 communication. (CVE-2026-50522)
Detects cross-process memory operations and CreateRemoteThread calls targeting explorer.exe or svchost.exe from non-standard (untrusted) process paths. This activity is consistent with StealC infostealer unpacking and injection behavior, typically following initial execution by SmartLoader as seen in recent FakeGit/AgentBaiting campaigns.
Detects instances where a process other than the legitimate Discord client or its updater accesses the Local Storage/leveldb directory. This path contains cached authentication tokens and session data, making it a frequent target for credential theft malware such as SectopRAT in the FakeAgent campaign.
Detects the Unicode RIGHT-TO-LEFT OVERRIDE character (U+202E) in process
command lines. Adversaries insert RTLO to reverse the rendering of a filename
so an executable payload displays as a benign document type.
command lines. Adversaries insert RTLO to reverse the rendering of a filename
so an executable payload displays as a benign document type.
This rule detects a suspicious pattern on Linux systems where a process creates a file in the /tmp directory with a name consisting of a long hexadecimal string (indicative of a hash, often used by Rust-based loaders for Sliver or similar implants), followed immediately by the execution of that same file by the initiating process.
Detects the loading of 'tempdir.dll', a module identified as implementing an anti-VM/sandbox gate. This mechanism queries DXGI adapter vendor IDs (e.g., QEMU 0x1234, VMware 0x15AD), checks for low VRAM allocation, and performs compute shader timing analysis to detect virtualization or sandbox environments prior to secondary payload execution.
Page 4 of 92