Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,222 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects a PowerShell command that carves an MSI file from a source file by searching for a specific byte sequence ('UUUU' or 0x55 four times). This novel technique has been used by a Chinese APT group as part of their infection chain, often initiated by a malicious LNK file.
Detects the creation of files with names used by Yurei ransomware to masquerade as legitimate system processes or backups in unusual locations.
Detects potential exploitation of VMware CVE-2025-41244, where a privileged VMware service discovery script executes a binary from a world-writable directory like /tmp. This behavior is consistent with the local privilege escalation technique used by UNC5174.
Detects a sequence of commands associated with UAT-8099 activity, where a new user (including hidden or test accounts) is created or the guest account is enabled, and then added to the Administrators and Remote Desktop Users groups. This pattern is used for establishing persistence and remote access.
Detects potential DLL side-loading activity associated with the Confucius threat group. This rule identifies when a legitimate executable, known to be abused by Confucius (e.g., fixmapi.exe), is run from a non-standard, user-writable directory and loads a suspicious DLL from the same location.
Detects a high volume of process and service terminations using 'taskkill.exe' and 'sc.exe' within a short time frame. This behavior is characteristic of ransomware like FunkLocker, which aggressively disables applications and services to prepare for encryption.
Detects a process execution chain characteristic of the ClickFix technique, where explorer.exe spawns a headless conhost.exe, which in turn leads to the execution of curl.exe to download a payload.
Detects the creation of suspicious script files (.vbs, .js, .ps1, .bat, .cmd) in the Windows Startup folder. This is a common persistence technique used by malware, including XWorm, to ensure execution upon user logon.
Detects the FlipSwitch Proof-of-Concept (PoC) Linux rootkit. This rootkit is designed to bypass modern Linux kernel (v6.9+) defenses by patching call instructions within the x64_sys_call function, a technique dubbed 'FlipSwitch'.
Detects a suspicious process or Living-Off-the-Land Binary (LOLBin) being launched by a Microsoft SQL Server process (sqlservr.exe). This behavior is often indicative of post-exploitation activity after a database server has been compromised.
Page 80 of 92