Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,219 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects enabling of Developer Mode via AllowDevelopmentWithoutDevLicense under AppModelUnlock. This is the sole precondition for the UNCanny technique (loose-file AppX registration from a UNC path -> SYSTEM LoadLibraryW coercion/LPE via the Windows Store InstallService). Low fidelity in isolation - Developer Mode is common on dev endpoints; correlate with UNC loose-file registration and svchost UNC image loads.
Detects post-exploitation of CVE-2026-22778 (vLLM libopenjp2 JPEG2000 cdef heap overflow). The overwritten AVBuffer free() pointer is set to system(), so a successful exploit spawns /bin/sh -c as a direct child of the vLLM/python inference process. Matches a shell or download/exec utility launched with a vLLM/python/uvicorn parent, excluding benign python worker children.
Detects Add-AppxPackage -Register against a manifest on a UNC path. Legitimate loose-file registration during development points at local paths; a UNC InstalledLocation is the core of UNCanny - it hands the SYSTEM Windows Store InstallService a LoadLibraryW on an attacker-controlled UNC via plugin resolution.
Detects the ClickFix social engineering technique where a user is coerced into copying and executing a malicious script from a web browser. The rule identifies instances where common web browsers spawn script interpreters such as powershell.exe, cmd.exe, mshta.exe, or wscript.exe, which is characteristic of the user pasting malicious commands into a command prompt interface.
Detects attempts to create rogue WordPress administrator accounts using indicators associated with the OptinMonster/TrustPulse supply chain attack. The rule specifically looks for POST requests to WordPress user creation endpoints (REST API, admin form, AJAX) containing campaign-specific identifiers like 'developer_api1', 'customer1usx', or patterns like 'dev_xxxxxx' in the response body or request URL. This covers the known vectors of the attack, aiming to identify the unauthorized creation of administrative users.
Detects the command line sequence used by Miasma to restore passwordless sudo for the 'runner' user in GitHub Actions by overwriting sudoers via a Docker container. This specific pattern targets the Miasma Alpine container payload.
Detects the creation of a new deviceManagementScript or deviceShellScript object in Intune, indicating a PowerShell (Windows) or Shell (macOS/Linux) script has been uploaded to the Intune management platform. This is considered a high-fidelity indicator of script-based abuse as these scripts execute as SYSTEM on targeted endpoints and leave minimal forensic traces. The rule also identifies script creation initiated by service principals that might bypass human-UPN-based monitoring.
Detects the execution of the 'search:' or 'search-ms:' URI handlers utilizing the 'crumb=location:' parameter pointing to a UNC path. This behavior forces outbound NTLM authentication and can be abused to leak Net-NTLMv2 hashes, exploiting an unpatched vulnerability similar to CVE-2026-33829 in the Snipping Tool.
This rule detects the creation of suspicious child processes by 'lsass.exe' on Windows systems. LSASS (Local Security Authority Subsystem Service) is a critical Windows process responsible for enforcing security policies. Under normal circumstances, LSASS should not spawn common command-line interpreters or system utilities like cmd.exe, powershell.exe, or rundll32.exe. Such activity is highly indicative of post-exploitation behavior, potentially following a successful compromise like the referenced CVE-2026-41089 Netlogon RCE, where an attacker might use LSASS to execute further commands or tools.
Detects the execution of Google Chrome with specific command-line flags (--hide-crash-restore-bubble and --disable-session-crashed-bubble) that are often used by malware like FlutterShell to suppress crash recovery prompts and potentially evade detection or user interaction. This behavior can indicate an attempt to hide malicious activity or maintain persistence without alerting the user to abnormal browser states.
Page 7 of 92