Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,218 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects a high frequency of 'shell' processes spawned by the same parent process, a behavior indicative of the LunoBotnet's watchdog-based self-healing and persistence mechanism. The parent process often masquerades as a kernel worker.
This rule detects potential C2 communication patterns associated with the NightshadeC2 botnet. It looks for outbound TCP connections from non-browser processes to specific ports used by the malware, or connections to Steam community pages which are used to host C2 addresses. It also identifies initial geo-IP lookups from non-browser processes.
Detects the use of 'curl' on macOS with specific flags (-f, -s, -L) commonly used to download and execute scripts from the internet. This pattern is a known technique used by malware like AMOS Stealer to gain initial access by tricking users into running malicious commands in the Terminal.
Detects the loading of `libcef.dll` by `vcpktsvr.exe` from non-standard directories. This specific DLL Sideloading behavior is a key tactic of the malware associated with the Termncolor/Colorinal malicious Python packages, where a legitimate executable is dropped into an unusual location to load a malicious DLL.
This rule detects a suspicious file download from a known web server or SQL related process which has been identified in the GhostRedirector campaign.
Detects incoming emails that contain suspicious attachment types (e.g., RAR, ZIP) or links to file-sharing services, combined with subject lines commonly used in phishing campaigns. This pattern is indicative of initial access attempts via spear-phishing.
Detects a sequence of events indicative of privilege escalation via TrustedInstaller token manipulation, a technique used by MostereRAT. The rule looks for a process starting the 'TrustedInstaller' service and then immediately launching a new process as the SYSTEM user.
Detects a high frequency of UAC consent prompts (consent.exe) originating from a single parent process, followed by the launch of a common Living Off The Land Binary (LOLBAS). This pattern is indicative of 'UAC Prompt Bombing' used to coerce a user into granting elevated privileges, as seen with the NightshadeC2 loader.
Detects the execution of multiple commands commonly used by Dire Wolf ransomware to delete backups, shadow copies, and event logs, thereby inhibiting system recovery. The rule triggers when more than one of these anti-recovery commands are executed on the same host within a 10-minute window, distinguishing malicious patterns from isolated, legitimate administrative actions.
Detects the execution of an executable or script file from the NETLOGON share. This behavior was observed during the deployment of the Obscura ransomware and is a strong indicator of lateral movement or malicious deployment via Group Policy.
Page 87 of 92