Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,222 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects the registration of a new IIS module using appcmd.exe, a technique used by adversaries to install malicious components like the BadIIS module for persistence and traffic interception. This rule looks for the specific 'chongxiede' module name or modules registered from suspicious file paths.
Detects the use of AWS IAM Policy Simulator APIs (SimulatePrincipalPolicy, SimulateCustomPolicy), which can indicate a threat actor is enumerating permissions to find privilege escalation paths.
Detects loaders associated with RainyDay, Turian, and a new PlugX variant, used by threat actors like Naikon and BackdoorDiplomacy. The rule identifies the shared unpacking routine which uses a combination of RC4 decryption and LZNT1 decompression (via RtlDecompressBuffer), along with specific RC4 keys, PDB paths, and hardcoded payload filenames.
Detects potential Cloudflare Under Attack Mode (UAM) bypass activity, characteristic of the ShadowV2 botnet. This involves the execution of a headless browser followed by network requests using a Cloudflare clearance cookie.
Detects a Windows command shell executing a batch file that subsequently spawns processes for system discovery (often for AV checking) and then either executes a potential payload or performs network reconnaissance. This behavior is consistent with the initial stages of the BlockBlasters malware campaign.
Detects the multi-stage DLL sideloading technique used by the Nimbus Manticore APT group. This rule identifies when the legitimate Windows Defender component 'SenseSampleUploader.exe' loads 'xmllite.dll' from a non-standard directory, a behavior indicative of the group's novel DLL path hijacking method.
Detects the execution of the Oracle Database Scheduler's External Job process (`extjobo.exe`) spawning a suspicious child process, such as PowerShell with an encoded command or the Windows Command Shell. This behavior was observed in Elons ransomware attacks for initial access and remote command execution.
Detects potential BlackLock ransomware activity where a process is launched with command-line arguments for network scanning and subsequently makes an SMB connection.
Detects potential DLL side-loading of the Turla Kazuar backdoor using legitimate executables launched from unusual, actor-specific file paths.
Detects a user authorizing a Salesforce application via the '/setup/connect' page. This specific TTP is associated with ShinyHunters vishing campaigns where attackers impersonate IT staff and trick employees into entering a connection code, thereby granting a malicious application access to the organization's Salesforce environment.
Page 83 of 92