Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,219 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects attempts to replace the legitimate UEFI bootloader (bootmgfw.efi) with a malicious one by creating a backup (.old file) and modifying the original. This is a critical persistence technique used by the HybridPetya ransomware.
This detection identifies the installation of known malicious Chrome extensions associated with the "Madgicx Plus" campaign, which targets Meta advertisers to steal credentials and hijack sessions. The rule looks for registry modifications that include the specific IDs of these malicious extensions.
Detects when 'msimg32.dll' is loaded from a non-standard directory, which can be an indicator of DLL hijacking.
Detects potential DLL side-loading where the legitimate Palo Alto Networks executable 'PanGpHip.exe' is launched from a non-standard directory and loads 'libwaapi.dll' from the same path. This behavior is consistent with the technique described in the dmpdump report, where an LNK file executes the legitimate application to load a malicious DLL.
Detects the loading of the vulnerable RTCore64.sys driver. This driver is exploited by threats like kkRAT to disable AV/EDR security callbacks as part of a Bring Your Own Vulnerable Driver (BYOVD) attack.
Detects modification of common macOS shell configuration files, a technique used by the ChillyHell backdoor for persistence.
Detects a sequence of events indicative of Process Doppelgänging, a technique used by APT37. This rule identifies a process creating a legitimate Windows utility and then immediately injecting code into it, which is characteristic of creating a process in a suspended state for injection.
Detects a LOLBAS (Living Off the Land Binary) executing a payload from a common staging directory, which is then followed by an outbound RDP connection from the same process. This behavior is indicative of a proxied RDP connection, often used for lateral movement after an initial compromise, as seen with malware like SystemBC.
Detects an exploit attempt against Sitecore vulnerability CVE-2025-53690. This rule correlates an HTTP POST request to '/sitecore/blocked.aspx' with a subsequent 'ViewState verification failed' Windows Event Log (EID 1316) from the same source IP and target host.
Detects multiple failed Multi-Factor Authentication (MFA) push attempts for a user from a single IP address, followed by a successful attempt within a short time window. This pattern can indicate an MFA push bombing or fatigue attack where an adversary spams a user with MFA requests until they approve one.
Page 86 of 92