Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,215 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects attempts to enable WDigest credential caching by modifying the 'UseLogonCredential' registry value. This allows plaintext credentials to be stored in memory, which can then be harvested by attackers. The threat group ShadowSilk has been observed using this technique.
Detects the use of curl.exe to exfiltrate data, particularly archived or disguised files, via HTTP POST requests or the '--upload-file' flag. This technique was observed being used by the 'Curly COMrades' threat actor to upload .rar archives to a compromised server.
Detects when new credentials are added to an Entra ID Service Principal, followed by a successful login from that principal within a short time frame. This pattern is consistent with MURKY PANDA TTPs for lateral movement and persistence in cloud environments.
Detects the execution of a shell script downloaded via curl or wget on macOS, a technique associated with ClickFix campaigns delivering malware like Atomic macOS Stealer (AMOS).
Detects the execution of legitimate file transfer or backup utilities like FileZilla (fzsftp.exe), Restic, or BackBlaze (b2.exe) that have been observed being abused by threat actors for data exfiltration.
Detects the execution of a legitimate SentinelOne executable, 'SentinelBrowserNativeHost.exe', from a suspicious location (such as user profile, ProgramData, or Temp directories), which then sideloads a malicious 'SentinelAgentCore.dll'. This is a technique used by Cephalus ransomware.
Detects defense evasion tactics used by UpCrypter, such as checking for forensic tools or sandbox environments.
Detects PowerShell commands, particularly those involving download and execution cradles (irm/iex), being written to the RunMRU registry key. This behavior is indicative of social engineering attacks like 'ClickFix' where users are tricked into pasting and running malicious commands via the Windows Run dialog.
Detects a Microsoft Office application spawning suspicious child processes to execute dropped files. This behavior is consistent with UAC-0057's use of weaponized XLS documents with VBA macros for initial access.
Enable Rdp Via Registry
YARA-L
Detects a registry modification to enable Remote Desktop Protocol (RDP) by setting the 'fDenyTSConnections' value to 0. This is a common technique used by threat actors, including those deploying KawaLocker, Medusa, and Crypto24 ransomware, to enable lateral movement or establish persistence.
Page 91 of 92