Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,263 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
This rule detects an attempt to exploit a critical vulnerability (CVE-2025-31324) in SAP NetWeaver Visual Composer's Metadata Uploader. The exploit leverages unauthenticated HTTP GET or HEAD requests to the '/developmentserver/metadatauploader' URI, combined with specific characters in the URI parameters (semicolon, dollar sign, backtick, pipe, or their URL-encoded equivalents) that indicate an attempt to execute arbitrary commands. This vulnerability allows an unauthenticated attacker to achieve remote command execution on the affected SAP system.
ET MOBILE_MALWARE Android/TrickMo.Banker Config Response
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sanguen .courses)
This rule detects attempts to exploit the Zip Slip vulnerability within TAR archives. Specifically, it looks for the sequence `../` (dot dot slash) within the file data of an inbound TAR archive, which indicates an attempt to write files outside of the intended directory during extraction. This is a common technique used in Zip Slip attacks to achieve directory traversal and potentially overwrite critical system files or place malicious files in arbitrary locations.
ET WEB_SPECIFIC_APPS Oracle E-Business Suite (EBS) Unauthenticated Template Manager Template Preview (CVE-2025-61882)
ET WEB_SPECIFIC_APPS Oracle E-Business Suite (EBS) Template Manager Template File Add (CVE-2025-61882)
ET INFO Remote Monitoring and Management (RMM) Tool in DNS Lookup (gorelo-rmm .azurewebsites .net)
Detects HTTP POST requests to F5 BIG-IP management or shared endpoints that contain long, base64-encoded payloads. Threat actors may use this technique to upload webshells or stage data for exfiltration.
ET MALWARE LeakyStealer CnC Checkin
This rule detects TLS Server Name Indication (SNI) requests for 'store.steampowered.com'. This domain is associated with the Valve Steam Store and its presence in TLS SNI could indicate activity related to information stealers like Vidar Stealer, which has been observed targeting Steam accounts.
Page 43 of 92