Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,260 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
This rule detects network traffic to specific JSON storage services (jsonkeeper.com, jsonsilo.com, npoint.io) that have been observed to be abused by the DPRK-linked 'Contagious Interview' threat actors for malware delivery. The detection is based on TLS Server Name Indication (SNI) patterns.
Detects execution of Node.js from unusual locations or associated with network connections to known C2 infrastructure, as seen in campaigns distributing backdoors disguised as legitimate software.
Detects the creation and subsequent hidden execution of a batch file, a technique used by XWorm to stage malicious code. The rule looks for a .bat file created in a temporary or user profile directory, which is then immediately run invisibly using the 'cmd /c start "" /min' command.
Detects phishing emails with malicious HTML attachments designed to harvest credentials and exfiltrate them via the Telegram Bot API. The detection looks for specific attachment filenames (e.g., RFQ, INQUIRY) or content patterns indicative of this threat.
Detects the use of the AADInternals PowerShell module, a tool used by threat actors like MERCURY and DEV-1084 for credential theft and privilege escalation in Azure AD environments.
Detects attempts to load unsigned kernel extensions, which may indicate rootkit installation or malicious kernel-level access. All legitimate kernel extensions should be signed with a developer ID.
Detects the use of PuTTY Link (plink.exe) with command-line arguments indicative of SSH tunneling, executed from a suspicious file path. This technique is used by the xHunt APT group for lateral movement and to create covert communication channels.
This rule detects inbound HTTP requests containing the User-Agent string 'Salesforce-Multi-Org-Fetcher/1.0'. This specific User-Agent has been associated with data theft from Salesforce instances, as detailed in a Google Cloud blog post. The detection aims to identify potential malicious activity targeting web server applications, specifically Salesforce environments, where an attacker might be attempting to exfiltrate data.
This rule detects inbound HTTP requests containing the User-Agent string 'Salesforce-CLI/1.0'. This activity is considered suspicious as it may indicate reconnaissance or data theft attempts targeting Salesforce instances, potentially leveraging compromised credentials or systems. The presence of this specific User-Agent inbound to a network could be an indicator of malicious activity, as Salesforce CLI is typically used by developers and administrators for managing Salesforce organizations and is not expected to be seen in inbound traffic from external networks to internal systems.
ET MOBILE_MALWARE Klopatra CnC Domain in DNS Lookup (guncel-tv-player-lnat .]com)
Page 40 of 92