Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,219 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects the DLL sideloading of `jli.dll` by `java.exe` from common malware staging directories. This technique was observed being used by ReadNimeLoader as part of a BlackBasta-associated campaign.
Detects attempts to list or dump macOS Keychain data using the built-in 'security' utility. This activity can be indicative of credential theft attempts by an adversary.
Detects a user accessing the keys for multiple distinct Azure Storage Accounts in a short period. This behavior is associated with the threat actor Storm-0501, who performs this action for credential access prior to data exfiltration.
Detects the use of the Visual Studio Code (VSCode) command-line interface to create a tunnel. This technique was observed in the TAOTH campaign for post-exploitation persistence and command and control.
Detects attempts to exploit the Sitecore Experience Platform HTML cache poisoning vulnerability (CVE-2025-53693). Attackers can send a crafted HTTP request to a specific XAML handler to poison the HTML cache, leading to website defacement or client-side code execution.
Detects attempts to exploit the Citrix NetScaler RCE vulnerability (CVE-2025-7775) by identifying a specific POST request to a vulnerable endpoint, followed by a GET request to verify code execution.
Detects the use of PsExec for lateral movement, a technique observed in use by Warlock ransomware affiliates. This rule identifies the creation or execution of the default PsExec service ('PSEXESVC.exe') on a target host.
Detects the use of known malicious or suspicious User-Agent strings associated with the UNC6395 data theft campaign targeting Salesforce instances.
Detects Inf0s3c Stealer, a Python-based malware that is typically packed with PyInstaller and then compressed with UPX. This rule identifies files containing artifacts from both packers, along with strings specific to the stealer.
Detects network requests to common IP geolocation services, such as 'ip-api.com/json'. This is a known anti-analysis technique used by malware, including a loader associated with the Silver Fox APT group, to determine if it is running in a research or sandbox environment by checking the public IP address, ISP, and organization.
Page 89 of 92