Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,215 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects the PureLog Stealer performing system and process reconnaissance using .NET capabilities reflectively loaded via PowerShell. The rule monitors for the combination of process enumeration (System.Diagnostics.Process/Win32_Process), system metadata harvesting (Environment class properties), and memory-only execution patterns (Reflection.Assembly.Load) within PowerShell script block logs.
Detects execution of 'npm install' or 'npm ci' commands that explicitly include '@marketfront' or '@tqm-mfe' scopes. This detection is designed to identify potential dependency confusion attacks where malicious actors publish public packages with the same names as internal private packages to trick build systems into downloading malicious code instead of legitimate internal modules.
Detects adversary cleanup activities where PowerShell is used to remove script files and shortcuts (.lnk, .js, .bat, .vbs) from common persistence and startup directories (APPDATA, PUBLIC, ProgramData, and Startup folder), often associated with Veil#Drop anti-forensic techniques.
Detects the execution of npm install commands that include known malicious package names associated with a supply chain attack linked to the Lazarus Group. These packages are designed to impersonate the legitimate 'rollup-plugin-polyfill-node' package.
Detects ClickFix clipboard-paste payloads by identifying fake 'human verification' comments embedded in the command line of commonly abused Living Off the Land Binaries (LOLBINs). These comments are used by attackers to disguise malicious commands as CAPTCHA steps (e.g., reCAPTCHA, Cloudflare Turnstile, 'not a robot', verification-id, Ray ID). This rule is technique-level and not actor-specific, complementing the ErrTraffic rule.
Detects exploitation activity associated with CVE-2025-8088 used by UAC-0226 (GIFTEDCROOK). The rule monitors for WinRAR-family archive tools dropping files into the startup folder, staging payloads into C:\ProgramData, and the subsequent logon execution chain where cmd.exe launches PowerShell to execute encoded commands or content from ProgramData.
EXPERIMENTAL: This rule detects RoguePlanet indicators when the Microsoft Defender Antimalware Service Executable (MsMpEng.exe) creates or modifies an executable (.exe, .dll, .sys) file within the System32 or SysWOW64 directories. This behavior can indicate a potential local privilege escalation (LPE) or other malicious activity, especially if Defender is being abused for remediation in a SYSTEM context. The rule specifically highlights 'wermgr.exe' as a high-interest target, but is generalized to catch any PE file.
Detects Meow RAT (ClickFix campaign) copying Chromium browser extension data directories associated with cryptocurrency wallets, including MetaMask (nkbihfbeogaeaoehlefnkodbefgpgknn), via osascript on macOS.
Detects instances where 'MpClient.dll', a legitimate Microsoft Defender component, is loaded by a process that is not a known, trusted Microsoft Defender executable. This behavior can indicate an attempt to abuse Defender's scanning or cleaning APIs for malicious purposes, as seen in 'RoguePlanet' style attacks.
Detects persistence from the postcss-minify-selector-parser npm typosquat Windows RAT (JFrog, Jun 2026). The Python/Nuitka implant (launched as chost.exe, a renamed python.exe running loader.py) writes an HKCU Run value named 'csshost'. Fires on a CurrentVersion\Run write where the value name is csshost OR the writing process is chost.exe.
Page 6 of 92