Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,219 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects a series of WMI queries used by Maranhão Stealer for system reconnaissance.
Detects attempts to add sensitive privileges to a process token, a common technique for local privilege escalation. This could be part of an exploit chain following an information disclosure vulnerability like CVE-2025-53136.
Detects the execution of a malicious Node.js payload, a technique used by the EvilAI malware campaign. EvilAI launches node.exe via cmd.exe to run a JavaScript file from the user's temporary directory. The script name follows a specific pattern (GUID followed by 'or', 'ro', or 'of').
Detects the execution of the PureCoder Rust Loader based on the specific command-line argument '/i:--type=renderer' required for its execution.
Detects potential Adversary-in-the-Middle (AiTM) phishing activity, commonly associated with frameworks like Evilginx. The rule identifies suspicious domain patterns where legitimate identity provider (IdP) domains are used as subdomains of another domain, or where IdP-related keywords are used in hyphenated subdomains.
Detects a sequence of file creations (.svg, .zip, .bat) on a single host within a short time window, which is indicative of a malicious SVG-based download campaign delivering payloads like XWorm and Remcos.
Detects persistence mechanisms associated with a Winos malware variant. This includes the creation of the 'Software\DeepSer' registry key or the modification of the 'User Shell Folders\Startup' key to redirect to a malicious folder.
Detects HijackLoader attempting to perform anti-virtual machine (VM) checks by querying for VirtualBox-specific registry keys from a PowerShell process that also initiates a network connection. This combination of behaviors is indicative of sandbox evasion.
Detects the ITarian RMM service (RmmService.exe) spawning a child process from various suspicious directories commonly used for malware staging. This behavior is associated with adversaries using ITarian for post-exploitation activities, such as dropping additional malware.
Detects the creation of a symbolic link in the Windows Defender Platform directory. This is a technique used to hijack the execution flow of Windows Defender, forcing it to run from an attacker-controlled location upon service restart or update.
Page 85 of 92