Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,219 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects attempts to bypass authentication in Fortra GoAnywhere MFT by exploiting a vulnerability (CVE-2025-10035). This is achieved by sending a crafted GET request to the Unlicensed.xhtml endpoint to trigger an exception and obtain a valid license request token, which is a prerequisite for further exploitation.
Detects a high volume of file rename operations where files are appended with a randomized 16-character hexadecimal extension. This is a characteristic behavior of LockBit 5.0 ransomware during its encryption phase.
Detects potential LINE VIPER tasking activity via Cisco ASA WebVPN authentication requests. This involves looking for specific XML elements (<client-cert> or <client-cert-auth-signature>) containing large Base64-encoded data, which is indicative of embedded shellcode.
Detects the execution of WerFaultSecure.exe with command-line parameters used to target and dump a specific process. This technique is used by tools like EDR-Freeze to suspend EDR and Antivirus processes by abusing the MiniDumpWriteDump function.
Detects when a legitimate Windows binary, MSBuild.exe or mtstocom.exe, initiates an outbound network connection. This behavior is not typical for these processes and is a technique used by malware like DarkCloud to evade defenses by process hollowing.
Detects the modification of the 'UserInitMprLogonScript' registry key to execute a PowerShell script with a hidden window. This persistence technique was used by the COLDRIVER APT group.
Detects the YiBackdoor persistence technique where a DLL is written to disk and subsequently configured to be executed by regsvr32.exe via a registry Run key.
Zloader Custom DNS C2
YARA-L
Detects Zloader's custom DNS tunneling protocol which uses multiple Base32 encoded subdomains for C2 communication.
Detects LESLIELOADER, a Go-based malware loader used by the Chinese state-sponsored group RedNovember (TAG-100, Storm-2077) to deliver payloads such as SparkRAT and Cobalt Strike.
Detects a PowerShell process launch shortly after a .LNK file was created by Discord. This pattern is indicative of malicious LNK files distributed via Discord to gain initial execution.
Page 82 of 92