Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,219 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects creation or manipulation of the ROTATE subdirectory within the Skylight Metrics Agent path by non-SYSTEM accounts. CVE-2026-7791 exploitation requires replacing the legitimate ROTATE directory with a junction point targeting the attacker's desired write location. The Skylight service then follows the junction during its log rotation, writing attacker-controlled files to the target with SYSTEM privileges. Any non-SYSTEM interaction with this specific path warrants investigation.
Detects attempts to read common HashiCorp Vault token paths from the filesystem, indicating potential credential harvesting by malware like Miasma stealer.
Detects the use of the `nsenter` utility targeting PID 1 to spawn a shell. This is a common container escape technique used to break out of a privileged container and execute commands on the underlying host.
Detects Atlas RAT anti-analysis behavior by monitoring for registry queries or interactions with the Windows Defender Application Guard (WDAG) RunOnce registry key. This rule specifically looks for registry events where the key name contains "RunOnce" and the value name contains "WDAG", indicating an attempt by malware to detect or interact with a sandbox environment.
This rule looks for URL patterns matching common SQLi keywords used to break out of the array key for CVE-2026-9082.
Detects sign-in or Microsoft Graph API activity using user-agent strings characteristic of ROADtools and similar Python-based identity-attack tooling. The rule generalizes beyond ROADtools to catch AzureHound, MicroBurst, MFASweep, GraphRunner, and similar identity attack frameworks by looking for scripting user-agents (python, requests, urllib, curl) which signal non-browser, non-app authentication that is inherently suspicious for Entra ID admin operations.
Detects PowerShell script block telemetry (Event ID 4104) containing P/Invoke declarations targeting advapi32.dll's CredEnumerate function or related Credential Manager APIs (CredRead, CredWrite). This technique bypasses standard cmdlets that may be monitored or restricted, providing direct API access to stored Windows credentials including RDP sessions, web service credentials, and enterprise application tokens. Generalizes well beyond specific campaigns to most PowerShell credential-theft families.
Detects an NGINX worker process spawning a shell or interpreter process, the post-exploitation primitive for CVE-2026-42945 (NGINX Rift). The exploit chain corrupts the ngx_pool_t cleanup handler and triggers system() with attacker-controlled shell commands, causing the nginx worker to fork /bin/sh with the -c flag. Since system() always invokes /bin/sh -c, the highest-fidelity match is nginx → /bin/sh -c <command>. Generalizes to catch arbitrary interpreter spawning (bash, python, perl, ruby, netcat variants, socat) which would result from any future post-exploitation pivot. Scoped to Linux because the exploit relies on the fork-based multi-worker architecture (Linux/BSD only). Windows nginx is not affected by the heap feng shui exploitation primitive.
Detects modifications to the Windows registry that disable the
Microsoft Vulnerable Driver Blocklist by setting
VulnerableDriverBlocklistEnable to 0. This technique is used by threat actors,
such as the PoisonX RAT, to load vulnerable drivers (BYOVD) and evade or blind
EDR sensors.
Microsoft Vulnerable Driver Blocklist by setting
VulnerableDriverBlocklistEnable to 0. This technique is used by threat actors,
such as the PoisonX RAT, to load vulnerable drivers (BYOVD) and evade or blind
EDR sensors.
Detects the DLL sideloading primitive used by the ValleyRAT (SilverFox APT)
campaign documented by K7 Labs: a legitimate signed Windows binary executing
from C:\ProgramData\ (typically C:\ProgramData\client\) that has been weaponized
to sideload an attacker-controlled DLL. The K7 analysis documents GameBox.exe
(Tencent) as the carrier in this campaign, but ValleyRAT operators rotate
sideloading carriers across campaigns - AntiyAVL.exe, DXVZ.exe, DXOPT.exe,
VPNclient.exe, and various Chinese-language application binaries have all been
observed as carriers. The stable detection target is the technique: any
binary executing from ProgramData OR utility.dll being loaded from ProgramData.
campaign documented by K7 Labs: a legitimate signed Windows binary executing
from C:\ProgramData\ (typically C:\ProgramData\client\) that has been weaponized
to sideload an attacker-controlled DLL. The K7 analysis documents GameBox.exe
(Tencent) as the carrier in this campaign, but ValleyRAT operators rotate
sideloading carriers across campaigns - AntiyAVL.exe, DXVZ.exe, DXOPT.exe,
VPNclient.exe, and various Chinese-language application binaries have all been
observed as carriers. The stable detection target is the technique: any
binary executing from ProgramData OR utility.dll being loaded from ProgramData.
Page 9 of 92