Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,226 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects potential exploitation attempts of Citrix NetScaler vulnerability CVE-2025-5777 (CitrixBleed 2). This involves malformed or unusually large HTTP POST requests to the /p/u/doAuthentication.do endpoint, a technique used by groups like Earth Estries.
Detects a high volume of emails being moved to the 'Deleted Items' folder from the 'Inbox' or 'Sent Items' folders by a single user in a short timeframe. This behavior is a known tactic used by threat actors, such as the 'Jingle Thief' group (CL-CRI-1032/Atlas Lion), to hide malicious activities like internal phishing by deleting the sent messages and any replies.
Detects a User Account Control (UAC) bypass attempt using the CMSTP COM interface. This specific rule looks for the process chain associated with the ValleyRAT campaign, where bypass.exe uses this technique to launch Nvidia.exe with elevated privileges.
Detects PowerShell execution patterns consistent with the Caminho Loader, which uses LSB steganography to extract a payload from a downloaded image file. This rule requires PowerShell Script Block Logging (Event ID 4104).
Detects when an Azure Blob Storage container's access level is changed to allow public access, or when a long-lived, highly privileged Shared Access Signature (SAS) token is created. Threat actors can use these methods for persistence and data exfiltration.
Detects the use of BITSAdmin to download a remote file with a potentially malicious extension. This technique is used by COLDRIVER's NOROBOT malware to retrieve subsequent stages.
Detects the use of PowerShell to decode a Base64 encoded string and write it to the filesystem. This technique is used by adversaries, including in the PassiveNeuron campaign, to drop web shells or other malicious payloads.
Detects the execution of a shell command characteristic of APT36's use of malicious .desktop files on Linux. The command typically involves using 'curl' to download a hex-encoded payload and 'chmod' to make it executable, often within the a tmp directory.
Detects the DLL side-loading of 'jli.dll' by 'keytool.exe' from common malware staging directories. This is a more generic version of a rule detecting a technique used by ValleyRAT in Operation Silk Lure.
Detects the installation of malicious npm packages, such as 'node-nvm-ssh', used by the Famous Chollima group. The detection focuses on suspicious post-install scripts executed by node.exe, which is a known TTP for this actor to deliver malware like BeaverTail and OtterCookie.
Page 76 of 92