Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,219 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects unusual or suspicious child processes spawned by 7-Zip (7z.exe or 7zG.exe). This behavior is indicative of post-exploitation activity following a successful vtable hijack via the CVE-2026-48095 NTFS heap buffer overflow vulnerability.
Detects browser processes making DNS queries or network connections to BNB Smart Chain RPC endpoints (and related EVM-compatible chain RPCs). This technique is a signal for EtherHiding-style attacks where malicious JavaScript injected into compromised websites queries smart contracts for payload retrieval. This generalizes beyond ClearFake to catch UNC5342 (North Korean DPRK) and other EtherHiding adopters documented since October 2025.
Detects Quick Assist spawning command interpreters (cmd.exe, powershell.exe, pwsh.exe) that execute common discovery and reconnaissance commands. This pattern is associated with hands-on-keyboard activity, as documented in campaigns like Nimbus RAT, and broader kill chains used by groups such as Storm-1811, Black Basta affiliates, and 3AM ransomware operators. The rule specifically looks for commands like 'whoami', 'ipconfig', 'systeminfo', 'hostname', 'net time', 'net user', 'net group', 'net localgroup', 'net view', 'nltest', 'qwinsta', 'tasklist', 'arp', 'route', 'netstat', '/domain', 'dsquery', and 'gpresult'.
ASP.NET ViewState Verification Failure
Cortex XDR
This rule detects ASP.NET ViewState verification failures, specifically looking for Event ID 1316 and event message containing 'Event code: 4009'. This can indicate an attempt to tamper with the ViewState, potentially leading to deserialization vulnerabilities or other web application attacks.
Detects co-occurrence of MicrosoftSystem64 binary execution and DNS queries to huggingface.co from the same host within a 5-minute window. MicrosoftSystem64 is a DPRK-attributed (FAMOUS CHOLLIMA / Contagious Interview) multi-platform RAT delivered via malicious npm packages that exfiltrates stolen credentials, screenshots, and wallet data to attacker-controlled HuggingFace datasets. SafeDep confirmed the exfiltration pipeline was actively operating with real victims as of May 28, 2026.
Detects the creation or modification of Exchange inbox rules used by Kali365 designed to suppress security alerts by moving, deleting, or marking as read emails containing specific keywords. This technique is often used by adversaries to hide their activities or prevent detection.
Detects the creation of the specific named pipe '\REDSUN' used by the RedSun exploit (CVE-2026-41091) for inter-process communication. This named pipe is a unique indicator of the RedSun exploit's activity, often associated with process injection or other inter-process communication mechanisms.
Detects the __DAEMONIZED=1 environment variable marker used by the vpmdhaj npm supply chain campaign (Mini Shai-Hulud) to spawn a detached credential-harvesting payload during npm install. This marker prevents re-entry when payload.bin is re-launched on subsequent require() calls. Microsoft explicitly recommends this detection, noting that the exact string __DAEMONIZED=1 has no legitimate npm ecosystem use, leading to near-zero false positives.
Detects COM hijacking of the Windows Color System Calibration Loader CLSID ({B210D694-C8DF-490D-9576-9E20CDBC20BD}). The Argamal RAT abuses this specific CLSID by modifying the InprocServer32 key in the user hive to establish startup persistence tied to user login via a default Windows scheduled task.
Detects the creation or modification of the 'DontOfferThroughWUAU'
registry value under the Microsoft MRT policy key. This is a known defense
evasion technique used by malware, such as the SilentCryptoMiner campaign, to
permanently prevent the Microsoft Malicious Software Removal Tool (MSRT) from
automatically updating or installing via Windows Update.
registry value under the Microsoft MRT policy key. This is a known defense
evasion technique used by malware, such as the SilentCryptoMiner campaign, to
permanently prevent the Microsoft Malicious Software Removal Tool (MSRT) from
automatically updating or installing via Windows Update.
Page 8 of 92