Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,267 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (dolmain .com)
ET EXPLOIT_KIT LandUpdate808 Domain (imf1 .com) in TLS SNI
ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (imf1 .com)
ET ATTACK_RESPONSE ClickFix Obfuscated Payload Inbound
ET ATTACK_RESPONSE PowerShell String Base64 Encoded Invoke-RestMethod (Zva2UtUmVzdE1ld) in DNS TXT Reponse
This rule detects the 'Zip Slip' vulnerability pattern within TAR archive uploads. Specifically, it looks for the sequence '../' (dot dot slash) in the file data of a TAR archive, which indicates an attempt to traverse directories and potentially write files outside the intended extraction directory. This is a common technique used in Zip Slip attacks to achieve arbitrary file write.
This rule detects the presence of the 'Unregister-ScheduledTask' PowerShell cmdlet within the HTTP response body. This could indicate an attacker attempting to remove persistence mechanisms, specifically scheduled tasks, from a compromised system after initial compromise or during cleanup phases. The detection is case-insensitive and looks for the command along with optional parameters like '-taskname' or '-taskpath'.
ET WEB_SPECIFIC_APPS Monsta FTP Server Side Request Forgery Attempt (CVE-2022-31827)
ET WEB_SPECIFIC_APPS Cacti links.php Multiple Parameters Cross Site Scripting Attempt (CVE-2024-43362, CVE-2024-43364)
ET WEB_SPECIFIC_APPS IPFire urlfilter.cgi QUOTA_USERS Parameter Cross Site Scripting Attempt (CVE-2025-34313)
Page 48 of 92