Georg Lauenstein
@gsecTrusted contributorCompletionist
11 followers458 downloads641 copies43 likes15,532 views
206 detections
Filters
Last updated
All Time
Detection languages
192
14
Categories
54
44
14
12
12
Platforms
71
31
6
5
3
Products / Services
12
9
8
4
4
MITRE Techniques
46
40
37
36
20
CVEs
3
3
2
2
1
Detects network communication to the Sapphire Sleet C2 server used in the easy-day-js npm supply chain compromise. The dropper contacts 23.254.164.92:8000 to download second-stage payloads after disabling TLS certificate verification.
Detects npm postinstall execution with TLS certificate verification bypass characteristic of Sapphire Sleet's supply chain attack. The malicious postinstall script disables certificate validation before contacting C2 infrastructure.
Detects DNS queries or outbound network connections to
attacker-controlled MeshCentral remote-management command-and-control
infrastructure used by the ShinyHunters threat actor during the Oracle
PeopleSoft exploitation campaign reported by Mandiant in June 2026.
attacker-controlled MeshCentral remote-management command-and-control
infrastructure used by the ShinyHunters threat actor during the Oracle
PeopleSoft exploitation campaign reported by Mandiant in June 2026.
Detects execution of detached hidden Node.js processes created by
the Sapphire Sleet dropper. The malware spawns second-stage payloads as fully
detached, window-hidden Node.js processes with randomly named .js files to
evade detection and maintain persistence.
the Sapphire Sleet dropper. The malware spawns second-stage payloads as fully
detached, window-hidden Node.js processes with randomly named .js files to
evade detection and maintain persistence.
Detects execution of the easy-day-js malicious npm package postinstall
hook used by Sapphire Sleet in their supply chain compromise. The package executes
an obfuscated dropper that disables TLS verification and downloads second-stage payloads
from attacker C2 infrastructure.
hook used by Sapphire Sleet in their supply chain compromise. The package executes
an obfuscated dropper that disables TLS verification and downloads second-stage payloads
from attacker C2 infrastructure.
Detects npm operations involving compromised Mastra packages that
were injected with the malicious easy-day-js dependency. Sapphire Sleet published
140+ poisoned versions across the @mastra scope, each containing easy-day-js as
a new dependency to enable supply chain compromise.
were injected with the malicious easy-day-js dependency. Sapphire Sleet published
140+ poisoned versions across the @mastra scope, each containing easy-day-js as
a new dependency to enable supply chain compromise.
Detects Node.js processes launched with TLS certificate verification disabled via NODE_TLS_REJECT_UNAUTHORIZED=0. The Sapphire Sleet easy-day-js dropper uses this technique to establish C2 communication without certificate validation.
Detects network connections to privnote.com used by UNC3753 for delivering installation commands during social engineering attacks. The threat actors use this self-destructing text service to transmit cURL commands and RMM installer links without leaving permanent browser footprints.
Detects HTTP connections to paste sites (glot.io, rentry.co) used by ClawHavoc campaigns as redirect intermediaries. These sites serve as payload staging areas allowing attackers to update malicious content without modifying published AI skills.
Detects exploitation of CVE-2026-42864, an unauthenticated SSRF in the FireFighter incident management application. Attackers can coerce the application to fetch arbitrary URLs, potentially exfiltrating AWS metadata credentials (IMDS) as Jira attachments.
Page 10 of 21