Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,214 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
Detects Component Object Model (COM) hijacking used by the Curly COMrades threat actor for persistence. This rule identifies registry modifications that alter specific CLSIDs related to the .NET NGEN task to load the MucorAgent malware.
Detects attempts to exploit a remote code execution vulnerability (CVE-2024-36401) in GeoServer. Attackers leverage crafted JXPath queries in WFS, WMS, or WPS requests to execute arbitrary commands via Java's getRuntime().exec() method.
Detects potential DLL Sideloading activity as used by LockBit ransomware operators. This rule identifies when a legitimate, signed application (e.g., MpCmdRun.exe, jarsigner.exe) loads a corresponding DLL from the same, non-standard directory, a common TTP for defense evasion.
Detects the execution of WMI-based tooling such as SharpWMI, WMICmd, or wmic.exe for remote command execution, a technique used by the threat actor UAT-7237.
Detects potential exploitation attempts against Ivanti Connect Secure devices for vulnerability CVE-2025-22457. This vulnerability is actively exploited in the wild. Attackers can send an abnormally long string composed of digits and periods in the 'X-Forwarded-For' HTTP header to trigger a stack-based buffer overflow, which can lead to remote code execution.
Detects the creation of specific ASPX web shells in the SharePoint LAYOUTS directory, a TTP associated with the exploitation of the 'ToolShell' vulnerabilities (e.g., CVE-2025-49706, CVE-2025-53770).
Page 92 of 92