Danny Y
@zendannyyTrusted contributorCompletionist
3 followers3,372 downloads962 copies13 likes34,167 views
375 detections
Filters
Last updated
All Time
Detection languages
217
71
32
20
11
Categories
211
89
31
25
19
Platforms
169
148
32
12
9
Products / Services
57
49
47
14
12
MITRE Techniques
152
109
107
75
34
CVEs
2
1
1
1
1
Detects error-log indicators of active CVE-2026-42945 (NGINX Rift) exploitation attempts
reported from May 2026: worker processes exiting on signal 11 after crafted requests against
vulnerable rewrite configurations. Pair with access-log URI anomaly rules on internet-facing NGINX.
reported from May 2026: worker processes exiting on signal 11 after crafted requests against
vulnerable rewrite configurations. Pair with access-log URI anomaly rules on internet-facing NGINX.
Detects enabling Hide500Users in com.apple.loginwindow plist preferences, which suppresses
sub-500 UID accounts from the login screen and System Settings.
sub-500 UID accounts from the login screen and System Settings.
Detects launching shells with history disabled via environment variables (separate from deleting history files),
consistent with impairing command history logging (Defense Evasion).
consistent with impairing command history logging (Defense Evasion).
Hidden User Use Case Monitors dslocal user plist modifications for IsHidden, indicating a concealed local account created or modified outside standard account management workflows.
Detects the use of curl to download files from Telegram to local temp folder, which may indicate initial malware staging.
Detects attempts to disable Gatekeeper assessment or modify System Integrity
Protection, common defense evasion before unsigned payload execution.
Protection, common defense evasion before unsigned payload execution.
Detects hiding a user home folder with chflags, complementing account-level hiding
documented in T1564.002.
documented in T1564.002.
Detects uncommon or suspicious child processes spawning from a VsCode process. This could indicate an attempt of persistence via VsCode tasks or terminal profiles.
This rule detects crashes in Nginx worker processes, specifically looking for messages indicating a 'signal 11' or 'SIGSEGV' error. This could be indicative of a vulnerability being exploited (e.g., CVE-2026-42945) or other critical software malfunctions.
Detects attempts to disable Gatekeeper assessment or modify System Integrity
Protection, common defense evasion before unsigned payload execution.
Protection, common defense evasion before unsigned payload execution.
Page 15 of 38