Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,263 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects the DLL sideloading of sbamres.dll by the legitimate VipreAV component vetysafe.exe. This technique has been associated with China-linked threat actors like Space Pirates, Kelp (Salt Typhoon), and APT41 subgroups.
ET MALWARE TA569 Middleware Server Domain in DNS Lookup (sessionstorexint .com)
ET ATTACK_RESPONSE ClickFix MSHTA Command Inbound
Detects the execution of the Supper SOCKS5 backdoor, used by the Vanilla Tempest threat actor, based on a unique command-line pattern involving DllRegisterServer and a .ULB file, which acts as a loader for the obfuscated payload.
ET WEB_SPECIFIC_APPS Django Data Exfiltration via SQLi (CVE-2025-64459)
ET WEB_SPECIFIC_APPS Nagios Log Server API Unauthorized Access to Elasticsearch Service (CVE-2025-44824)
ET MALWARE TA569 Middleware Server Domain in DNS Lookup (taskrunnersrvmod .com)
ET INFO Remote Monitoring and Management (RMM) Tool in TLS SNI (gorelo-rmm .azurewebsites .net)
This rule detects attempts to exploit a deserialization vulnerability (CVE-2018-8421) in Microsoft SharePoint via a crafted workflow. The detection specifically looks for HTTP POST requests to the `/_vti_bin/webpartpages.asmx` endpoint containing `ValidateWorkflowMarkupAndCreateSupportObjects` and `workflowMarkupText` with CDATA, indicating an attempt to inject malicious XML.
ET ATTACK_RESPONSE HTML Smuggling Powershell Payload In href
Page 46 of 92