Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,267 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
ET INFO DYNAMIC_DNS Query to a *.destroyerkisscover .com .br domain
ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (forrbes .com)
ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (varorg .com)
ET ATTACK_RESPONSE PowerShell String Base64 Encoded Invoke-RestMethod (2b2tlLVJlc3RNZX) in DNS TXT Reponse
This rule detects an unauthenticated command injection vulnerability (CVE-2025-25256) in Fortinet FortiSIEM's phMonitor component. The detection is based on specific byte sequences and a PCRE regex matching command injection characters within the 'archive_nfs_archive_dir' parameter in TCP traffic to port 7900.
This rule detects suspicious WebAssembly (WASM) code in HTTP responses that indicates the allocation of Read-Write-Execute (RWX) memory pages. This pattern is a common precursor to shellcode execution within a web browser, often used by exploit kits or malicious websites to achieve arbitrary code execution. The rule specifically looks for JavaScript code that initializes a WebAssembly module with a byte array containing specific patterns indicative of RWX memory allocation, followed by instantiation and export calls.
This rule detects the presence of the 'schtasks /change' command within the HTTP response body. This could indicate an attacker modifying scheduled tasks on a compromised Windows system, potentially for persistence, privilege escalation, or lateral movement. The detection specifically looks for 'schtasks' and '/change' followed by '/tn' (task name) in a case-insensitive manner within HTTP responses with a 200 status code.
ET WEB_SPECIFIC_APPS Monsta FTP Arbitrary File Upload Attempt (CVE-2025-34299)
ET WEB_SPECIFIC_APPS Adobe Coldfusion BlazeDS Java Object Deserialization Remote Code Execution (CVE-2017-3066)
ET WEB_SPECIFIC_APPS Tenda DatabaseiniSet Time Parameter Buffer Overflow Attempt (CVE-2025-12618)
Page 50 of 92