Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,215 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
This rule detects potential Adversary-in-the-Middle (AiTM) phishing attacks targeting Microsoft 365. It monitors for suspicious network connections to known Evilginx-style subdomains (e.g., owa, sso, secure, billing) that proxy traffic to login.microsoftonline.com, followed immediately by a successful user login event on the same host. This pattern indicates an active session hijacking attempt designed to capture session cookies like ESTSAUTH and ESTSAUTHPERSISTENT.
Detects the Miasma loader, associated with supply chain attacks on NPM packages (e.g., ShinyHunters campaign), spawning a hidden, detached Node.js child process during module import. The detection monitors for a Node.js process spawning a child node.exe with the '-e' flag and a specific obfuscated variable prefix used by the malware to execute malicious code while bypassing --ignore-scripts.
This rule detects file-level activity associated with the known malicious version of the ModHeader browser extension (Extension ID: idgpnmonknjnojddfkpgkljpfnnfcklj). It flags the presence of specific indexedDB LevelDB files and temporary directories that are characteristic of the malicious update, which was used for unauthorized data access and browser-based persistence.
Detects the execution of a process named 'AppLaunch.exe' from a directory other than the standard .NET Framework installation paths. Adversaries may masquerade as this legitimate .NET binary to evade detection, as it is a trusted system utility.
Detects a hidden, non-interactive PowerShell process that programmatically enumerates mounted disk images (VHDX/ISO) using Get-DiskImage or Get-Partition, dismounts them, and potentially deletes the backing files. This behavior is indicative of post-execution cleanup routines used by malware delivered via mounted container images, such as the Overlord RAT.
This rule detects potential OAuth Device Code Flow phishing attacks where users are directed to malicious lure pages on romnor[.]ca to enter a Microsoft device code. It also alerts on authentication activity associated with a specific malicious OAuth client ID (d3590ed6-52b3-4102-aeff-aad2292ab01c) known to be used by a phishing backend to poll and claim OAuth tokens.
Detects when the administrative user account for an Azure Container Registry (ACR) is enabled. Enabling the admin user creates a static username and password for registry access, which may bypass modern identity-based access controls like Microsoft Entra ID (formerly Azure AD) and increase the risk of credential-based attacks.
Detects a sign-in failure with error code 50199 (indicating a device-code interrupt/waiting state) followed immediately by a successful sign-in from the same source IP address. This pattern is characteristic of device-code phishing attacks, where an attacker intercepts a device code and completes the authentication process on behalf of the victim.
Detects Microsoft Entra ID sign-in events using the non-interactive OAuth device-code protocol against the 'common' tenant endpoint where MFA was not applied. This behavior is consistent with OAuth device-code phishing campaigns (e.g., Storm-2372/DEBULL) that exploit Conditional Access device-code flow allowances to bypass standard authentication controls.
Detects obfuscated PowerShell execution (utilizing common bypass and hiding flags) that subsequently spawns the C# compiler (csc.exe) from suspicious locations (AppData, Temp, or tmp directories). This pattern is consistent with fileless payload delivery and runtime compilation, such as that observed in recent NeptuneRAT campaigns leveraging Chrome Native Messaging.
Page 5 of 92