Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,263 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
ET MOBILE_MALWARE Klopatra CnC Domain in DNS Lookup (adsservice2 .org)
ET WEB_SPECIFIC_APPS VMware Workspace ONE Access OAuth2TokenResourceController ACS Authentication Bypass (CVE-2022-22956)
ET WEB_SPECIFIC_APPS Oracle E-Business Suite (EBS) Authentication Bypass (SyncServlet) (CVE-2025-61882)
This rule detects the 'Zip Slip' vulnerability pattern within incoming ZIP archives. Specifically, it looks for the sequence '..\' (dot dot backslash) in the file data of a ZIP archive, which is indicative of an attempt to extract files outside of the intended directory. This vulnerability can lead to directory traversal and arbitrary file overwrite.
ET MOBILE_MALWARE Android/TrickMo.Banker POST Request
ET WEB_SPECIFIC_APPS Adobe ColdFusion Unauthenticated Remote Code Execution (CVE-2023-29300)
This rule detects attempts to exploit an insecure deserialization vulnerability (CVE-2025-53690) in Sitecore Experience Platform via exposed ASP.NET MachineKeys. It specifically looks for HTTP POST requests to '/sitecore/blocked.aspx' containing a '__VIEWSTATE' parameter with a highly encoded string, indicative of a crafted ViewState payload used in deserialization attacks.
ET MOBILE_MALWARE Klopatra CnC Domain in DNS Lookup (adsservices .uk)
Detects common shell processes launching a reverse shell using the '/dev/tcp' redirection. This technique is known to be used by adversaries like the Clop ransomware group for persistence and command and control.
ET WEB_SPECIFIC_APPS Oracle E-Business Suite (EBS) Template Manager Template Copy (CVE-2025-61882)
Page 42 of 92