Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,231 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects the use of command-line download tools to write a file with a web-related extension to a common web server directory. This behavior is consistent with webshell deployment, as seen in Sandworm campaigns.
Detects the execution of a malicious LNK file exploiting the ZDI-CAN-25373 vulnerability, a technique used by threat actors like UNC6384. The exploit involves padding the command line arguments with excessive whitespace to hide the malicious command from the user in the file's properties. This rule identifies command or powershell execution containing a large amount of whitespace characters, which is characteristic of this technique.
Detects processes with names used by Qilin malware (`hosts.exe`, `dato.exe`) that are launched without a visible window and subsequently make an outbound network connection. This pattern is indicative of a hidden C2 beacon, a technique used by Qilin to evade user detection.
Detects a process exhibiting multiple behaviors associated with Warlock ransomware. This rule correlates the termination of critical services, deletion of volume shadow copies within a short time window.
Detects the execution of legitimate tools (like sshd, tor, obfs4proxy) or their renamed counterparts from user-writable directories, specifically within AppData folders. This technique is associated with Operation SkyCloak to establish persistence and covert communication channels by masquerading as legitimate software.
Detects the XOR decryption function used in macOS variants of OceanLotus (APT32). This rule targets a specific byte sequence identified in the malware's decryption routine.
Detects Airstalk malware, used by the CL-STA-1009 threat cluster. This rule identifies both PowerShell and .NET variants that misuse the AirWatch MDM API for C2 and data exfiltration.
Detects a suspicious Salesforce OAuth login followed by high-volume data exfiltration activity within a short period. This pattern is associated with the threat actor UNC6040, which uses malicious or compromised OAuth applications to steal data.
Detects the loading of version.dll from a non-standard directory, a technique associated with DLL Sideloading. This specific variant was observed being used by a loader for TorNet and PureHVNC.
Detects the execution of a script file (e.g., VBS, JS, BAT, PS1) from a removable drive using a common script interpreter. This technique is used by the threat actor Tangerine Turkey for initial access.
Page 74 of 92