Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,244 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
ET INFO Blockchain RPC Domain in TLS SNI (mainnet .optimism .io)
This rule detects attempts to exploit a vulnerability in Xerox FreeFlow Core (CVE-2025-8356) that allows for arbitrary file upload and directory traversal. The detection logic looks for HTTP POST requests with a specific content type ('multipart/related' and 'application/vnd.cip4-jmf+xml') and a 'Content-Disposition: attachment; filename="' header, combined with a PCRE regex matching directory traversal patterns (e.g., '../', '..\'). This indicates an attacker is trying to upload a malicious file or traverse directories on the server.
ET INFO Blockchain RPC Domain in TLS SNI (polygon-rpc .com)
ET ATTACK_RESPONSE Base64 Encoded Powershell Performing Byte Operations Inbound
ET ATTACK_RESPONSE Koi Loader/Stealer CnC Config Inbound
Detects the enablement of the Hyper-V feature, particularly when the management clients are disabled simultaneously. This combination of actions is a technique used by the Curly COMrades threat actor to create a hidden virtualized environment for evasion purposes.
Detects a command-line pattern using a ping loopback command to create a delay, a technique used by malware like DarkTortilla/CHAMELEON#NET to evade automated sandbox analysis.
This rule detects the presence of the PowerShell cmdlet 'Enable-ScheduledTask' within the HTTP response body. This could indicate an attacker using a web server to deliver or instruct a client to enable a scheduled task, potentially for persistence or privilege escalation. The detection specifically looks for 'enable-scheduledtask' case-insensitively, optionally preceded by '-taskname' or '-taskpath', within a successful HTTP 200 OK response.
This rule detects the string "schtasks" followed by "/end" and then "/tn" within the HTTP response body. This pattern indicates that a client is receiving a response that contains a command to end a scheduled task using the `schtasks` utility. This could be part of a command-and-control communication or a lateral movement attempt where an adversary is managing scheduled tasks on a compromised system.
This rule detects the presence of 'schtasks' followed by '/delete' and '/tn' (task name) in the HTTP response body with a 200 status code. This could indicate an attacker attempting to delete scheduled tasks on a compromised Windows system, potentially to remove forensic evidence or disrupt legitimate operations. The detection is case-insensitive and uses a PCRE to match the specific command structure.
Page 70 of 92