Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,227 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
This rule detects an attempt to exploit a buffer overflow vulnerability (CVE-2025-9299) in Tenda routers. The exploit targets the `/goform/getMasterPassengerAnalyseData` endpoint via an HTTP POST request, specifically looking for an overly long 'time' parameter in the request body, which could lead to a buffer overflow.
Lumma Stealer Payload Inbound
Suricata
This rule detects the inbound transfer of a Lumma Stealer payload over HTTP. Specifically, it looks for a unique content string within the HTTP response body, indicating the download of a DLL file associated with Lumma Stealer. The content string 'filename="fuckingdllENCR.dll"' is a strong indicator of this specific malware.
Detects outbound network connections to the OpenAI API from unusual processes, a TTP used by the SesameOp backdoor for command and control (C2).
Detects process crashes within the Samsung 'libimagecodec.quram.so' library, which could indicate an exploitation attempt related to the LANDFALL spyware (CVE-2025-21042, CVE-2025-21043).
Detects PowerShell command clobbering techniques, where a module is installed or imported with the intent to overwrite existing system commands. This can be used in supply chain attacks via repositories like PowerShell Gallery.
Detects the creation of a Keras model file (.keras) that contains suspicious file paths or URLs. This may indicate an attempt to exploit CVE-2025-12058 for local file inclusion or server-side request forgery (SSRF).
Detects the spawning of command-line interpreters (`cmd.exe` or `powershell.exe`) from processes associated with Windows Server Update Services (WSUS), such as `w3wp.exe` (IIS worker process for WSUS) and `wsusservice.exe`. This behavior is a strong indicator of post-exploitation activity related to vulnerabilities like CVE-2025-59287, where attackers gain remote code execution on the WSUS server.
Detects the compilation of an executable in a temporary directory, followed by its execution and subsequent deletion. This pattern is indicative of an adversary attempting to compile and run tools on a target system while minimizing forensic artifacts.
Detects the execution of the Ligolo-ng tunneling tool, which is used by the Silent Lynx APT group for command and control and network pivoting.
Detects DLL side-loading patterns associated with the Lazarus Group's Operation DreamJob campaign. This involves legitimate Windows executables loading malicious DLLs from non-standard paths.
Page 73 of 92