Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
2
1
Contributors
3
Categories
1
1
1
1
Platforms
3
Products / Services
2
1
MITRE Techniques
2
2
1
1
CVEs
71
71
64
58
49
Detects a process other than screensharingd binding to macOS Screen Sharing port 5900 shortly after being newly spawned, indicating potential exploitation of the CVE-2026-43779 connection-interception logic flaw.
Flags macOS hosts below fixed builds (26.6.1/15.7.9/14.8.9) with an actively listening Screen Sharing process, distinguishing genuinely exposed unpatched hosts from mere version drift.
Detects a process other than screensharingd bound to or handling network traffic on screensharingd's expected port (5900), indicating exploitation of the connection-interception logic flaw (CVE-2026-43779).