Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,222 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects the execution of suspicious file types from a user's 'Music' folder. This is an uncommon behavior used by the CountLoader malware for staging payloads.
Detects network connections to the 'webhook.site' domain, which is used as an exfiltration endpoint by the 'Shai-Halud' supply chain attack campaign. The risk score is elevated if the specific malicious URL path is observed.
Detects the execution of a Windows Shortcut File (.lnk) that is masquerading as an image file. This technique is used by threat actors like APT29 to trick users into executing malicious code, often delivered within an ISO or ZIP file.
Detects modification of an AWS IAM role's trust policy to include a principal from an unknown or untrusted AWS account. This is a common persistence technique used by attackers to maintain access to a compromised environment by allowing their external account to assume the role.
Detects the creation or modification of files with names suggesting they contain plaintext credentials, such as passwords or recovery codes. This is a common tactic used by threat actors to find and steal credentials for lateral movement and privilege escalation.
MCP Remote RCE Via Oauth
YARA-L
Detects potential remote code execution via a malicious OAuth URL in the mcp-remote proxy tool, indicative of CVE-2025-6514 exploitation.
Detects processes potentially related to XillenStealer making outbound network connections or DNS queries for telegram.org. This is indicative of command and control or data exfiltration activity.
Detects the creation of a mutex with a pattern matching new SmokeLoader versions (2025 alpha and 2025). The malware's main module is injected into explorer.exe, which then creates this distinct mutex to prevent multiple instances from running.
Detects the creation of a malicious executable named 'My Pictures.exe' on a removable drive, a technique used by VenomRAT for lateral movement.
Detects fake image files (BMP, GIF, JPEG, PNG, TIFF) used by the BeardShell backdoor for command and control communications. These files contain an encrypted payload and a size field that matches the file's total size, a technique used by APT28 in the Phantom Net Voxel campaign.
Page 84 of 92