Georg Lauenstein
@gsecTrusted contributorCompletionist
11 followers468 downloads740 copies45 likes15,786 views
211 detections
Filters
Last updated
All Time
Detection languages
197
14
Categories
56
46
14
12
12
Platforms
76
31
6
5
3
Products / Services
13
9
8
4
4
MITRE Techniques
47
43
38
37
21
CVEs
3
3
2
2
1
Detects npm operations involving compromised Mastra packages that
were injected with the malicious easy-day-js dependency. Sapphire Sleet published
140+ poisoned versions across the @mastra scope, each containing easy-day-js as
a new dependency to enable supply chain compromise.
were injected with the malicious easy-day-js dependency. Sapphire Sleet published
140+ poisoned versions across the @mastra scope, each containing easy-day-js as
a new dependency to enable supply chain compromise.
Detects Node.js processes launched with TLS certificate verification disabled via NODE_TLS_REJECT_UNAUTHORIZED=0. The Sapphire Sleet easy-day-js dropper uses this technique to establish C2 communication without certificate validation.
Detects network connections to privnote.com used by UNC3753 for delivering installation commands during social engineering attacks. The threat actors use this self-destructing text service to transmit cURL commands and RMM installer links without leaving permanent browser footprints.
Detects HTTP connections to paste sites (glot.io, rentry.co) used by ClawHavoc campaigns as redirect intermediaries. These sites serve as payload staging areas allowing attackers to update malicious content without modifying published AI skills.
Detects exploitation of CVE-2026-42864, an unauthenticated SSRF in the FireFighter incident management application. Attackers can coerce the application to fetch arbitrary URLs, potentially exfiltrating AWS metadata credentials (IMDS) as Jira attachments.
Detects cURL command used by UNC3753 to download SuperOps RMM agent during social engineering attacks. The threat actor instructs victims to execute this specific command pattern to install persistent remote access tools for data theft operations.
Detects exploitation attempts of CVE-2026-9384, a critical command injection vulnerability in Totolink A8000RU routers. Attackers target the 'setDiagnosisCfg' function in '/cgi-bin/cstecgi.cgi' by injecting OS commands into the 'ip' parameter.
Detects exploitation attempts of a Path Traversal vulnerability (CWE-22) in UniFi OS devices. Attackers use directory traversal sequences to access sensitive system files like /etc/passwd or shadow files to gain unauthorized account access.
Detektiert Gremlin Stealer TTPs wie Crypto-Clipping oder Session-Hijacking durch Analyse von verdächtigen Prozessbefehlen und Ressourcen-Manipulation laut Unit 42 Bericht.
Detects exploitation attempts of CVE-2026-48172 in the LiteSpeed User-End cPanel Plugin. Attackers abuse the redisAble function to escalate privileges, potentially to root, by mishandling Redis enable/disable features.
Page 11 of 22