Georg Lauenstein
@gsecTrusted contributorCompletionist
11 followers468 downloads740 copies45 likes15,786 views
211 detections
Filters
Last updated
All Time
Detection languages
197
14
Categories
56
46
14
12
12
Platforms
76
31
6
5
3
Products / Services
13
9
8
4
4
MITRE Techniques
47
43
38
37
21
CVEs
3
3
2
2
1
Detects connections to domains associated with the Montana Empire phishing kit, which leverages AI-hallucinated postal service domains for credential harvesting. This kit targets phantom domains identified through LLM hallucination prediction and exploits AI-generated domain suggestions.
Detects connections to AI-hallucinated API endpoints commonly generated by coding assistants. These phantom domains are weaponized by adversaries to intercept CI/CD pipeline telemetry, build notifications, and developer authentication tokens from automated systems.
Detects network connections to Telegram bot API endpoints consistent with the Montana Empire phishing kit's credential exfiltration mechanism. This kit uses Telegram as a C2 channel for real-time data theft from phantom squatting domains that exploit AI-hallucinated URLs.
Detects network communication to OpenClaw malicious infrastructure. OpenClaw operates a skill marketplace that distributes AI-generated malware and exploits, representing an emerging supply chain threat to organizations.
Detects file creation or process launch of a MeshCentral
remote-management agent that has been renamed to impersonate an Azure
service, or whose hash matches a known sample, as used by the ShinyHunters
threat actor for persistent remote access during the Oracle PeopleSoft
exploitation campaign reported by Mandiant in June 2026.
remote-management agent that has been renamed to impersonate an Azure
service, or whose hash matches a known sample, as used by the ShinyHunters
threat actor for persistent remote access during the Oracle PeopleSoft
exploitation campaign reported by Mandiant in June 2026.
Detects network communication to the Sapphire Sleet C2 server used in the easy-day-js npm supply chain compromise. The dropper contacts 23.254.164.92:8000 to download second-stage payloads after disabling TLS certificate verification.
Detects npm postinstall execution with TLS certificate verification bypass characteristic of Sapphire Sleet's supply chain attack. The malicious postinstall script disables certificate validation before contacting C2 infrastructure.
Detects DNS queries or outbound network connections to
attacker-controlled MeshCentral remote-management command-and-control
infrastructure used by the ShinyHunters threat actor during the Oracle
PeopleSoft exploitation campaign reported by Mandiant in June 2026.
attacker-controlled MeshCentral remote-management command-and-control
infrastructure used by the ShinyHunters threat actor during the Oracle
PeopleSoft exploitation campaign reported by Mandiant in June 2026.
Detects execution of detached hidden Node.js processes created by
the Sapphire Sleet dropper. The malware spawns second-stage payloads as fully
detached, window-hidden Node.js processes with randomly named .js files to
evade detection and maintain persistence.
the Sapphire Sleet dropper. The malware spawns second-stage payloads as fully
detached, window-hidden Node.js processes with randomly named .js files to
evade detection and maintain persistence.
Detects execution of the easy-day-js malicious npm package postinstall
hook used by Sapphire Sleet in their supply chain compromise. The package executes
an obfuscated dropper that disables TLS verification and downloads second-stage payloads
from attacker C2 infrastructure.
hook used by Sapphire Sleet in their supply chain compromise. The package executes
an obfuscated dropper that disables TLS verification and downloads second-stage payloads
from attacker C2 infrastructure.
Page 10 of 22