Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
11 detections
Filters
Last updated
All Time
Detection languages
7
3
1
Contributors
11
Categories
6
3
2
2
2
Platforms
11
Products / Services
10,844
9,798
6,760
4,421
3,776
MITRE Techniques
5
4
3
2
2
CVEs
7
4
2
2
IDS Classtypes
2
1
IDS Protocols
3
Detects SSFileCopySender/SSFileCopyReceiver helpers running as uid=0 reading or writing sensitive system paths during Screen Sharing sessions using legacy VNC auth or lacking a preceding valid local logon — abuse of the root file-copy primitive underlying CVE-2026-65400.
Detects creation of LaunchAgent/LaunchDaemon plists, /etc/zshenv, or SSH authorized_keys attributed to screensharingd/helpers or occurring within a Screen Sharing session window — persistence via the root file-write primitive.
Detects legacy RFB security-type 2 (VNC password) authentication negotiation against macOS Screen Sharing from external sources, indicating legacy-VNC administration or abuse of the CVE-2026-43760 legacy-auth path that retains root file-copy authority.
Detects a process other than screensharingd binding to macOS Screen Sharing port 5900 shortly after being newly spawned, indicating potential exploitation of the CVE-2026-43779 connection-interception logic flaw.
Detects the CVE-2026-65400 pre-auth bypass exploitation of macOS Screen Sharing via an oversized RFB SRP (security-type 36) authentication frame length field, correlated with the connection subsequently reaching an authenticated state.
Detects sudoers.d writes attributed to screensharingd/helper followed within minutes by passwordless (sudo -n) execution for a previously-unprivileged account, optionally correlated with a dropped callback script.
Detects the navi_the_clown macOS Screen Sharing pre-auth RCE PoC binary via hash/filename/command-line flag or, as a lower-confidence secondary indicator, codesign+xattr Gatekeeper-bypass staging correlated with the PoC filename or flags
Flags macOS hosts below fixed builds (26.6.1/15.7.9/14.8.9) with an actively listening Screen Sharing process, distinguishing genuinely exposed unpatched hosts from mere version drift.
Detects completed RFB/VNC protocol handshakes to internal macOS Screen Sharing hosts (TCP/5900) from external networks, thresholded to separate reconnaissance/scanning from single stray connections. Early-warning exposure signal for CVE-2026-65400 targeting.
Detects repeated screensharingd crash/restart cycles tightly time-correlated with file-copy helper activity, indicating CVE-2026-43777 DoS exploitation alongside its secondary file-copy abuse potential.
Detects screensharingd or its child helper processes accessing TCC-protected data categories on hosts with no prior TCC grant recorded for screensharingd, indicating a TCC bypass via the Screen Sharing exploit chain.