Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,222 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects a suspicious sequence where a JavaScript file is executed, followed shortly by the execution of a Windows Installer (MSI) package on the same host. This pattern is consistent with the initial access technique used by threat actors like Lunar Spider, where a malicious script downloads and runs a subsequent payload.
Detects Acreed infostealer's cryptocurrency clipper activity. This rule identifies when a host first communicates with a known Acreed C2 domain (`trustdomainnet.live`) to fetch malicious wallet addresses, and then communicates with a QR code generation API (`api.zile42o.dev`) used to replace legitimate QR codes with malicious ones.
Detects potential BRICKSTORM C2 activity. This rule identifies processes initiating a WebSocket connection over HTTPS, which is a technique used by BRICKSTORM for its command and control channel. The rule filters for processes that lack file metadata, a common characteristic of Go-based malware like BRICKSTORM.
Detects Olymp Loader defense evasion techniques, such as disabling Windows Defender features or adding broad folder exclusions via PowerShell, and the execution of a known 'Defender Remover' tool.
Detects registry modifications associated with the Gentlemen ransomware group. These changes are intended to weaken security controls for NTLM, Remote Desktop Protocol (RDP), and administrative access to facilitate lateral movement and persistence.
Detects the creation or modification of a GitHub Actions workflow file that attempts to exfiltrate secrets. This pattern is associated with the Shai-Hulud worm, which injects malicious workflows to steal credentials using `toJSON(secrets)` and exfiltrate them using tools like `curl` and `base64`.
Detects exploitation attempts against common network edge devices (Cisco, Ivanti, Palo Alto) associated with Salt Typhoon's TTPs for initial access.
Detects the creation of or connection to named pipes commonly associated with PsExec activity, which is often used for lateral movement. This includes the default 'psexesvc' pipe and patterns used by impacket's psexec.py.
Detects the execution of various infostealers and RATs, such as BeaverTail, OtterCookie, WeaselStore, and AkdoorTea, used by the North Korea-aligned threat actor DeceptiveDevelopment.
Detects the execution of the HTML Help executable (hh.exe) followed closely by the execution of mshta.exe loading a remote resource. This pattern is indicative of a malicious CHM file being used to launch a remote HTA file, a technique observed in a campaign delivering Amatera Stealer and PureMiner.
Page 81 of 92