Danny Y
@zendannyyTrusted contributorCompletionist
3 followers3,372 downloads955 copies13 likes34,081 views
375 detections
Filters
Last updated
All Time
Detection languages
217
71
32
20
11
Categories
211
89
31
25
19
Platforms
169
148
32
12
9
Products / Services
57
49
47
14
12
MITRE Techniques
152
109
107
75
34
CVEs
2
1
1
1
1
Detects error-log indicators of active CVE-2026-42945 (NGINX Rift) exploitation attempts
reported from May 2026: worker processes exiting on signal 11 after crafted requests against
vulnerable rewrite configurations. Pair with access-log URI anomaly rules on internet-facing NGINX.
reported from May 2026: worker processes exiting on signal 11 after crafted requests against
vulnerable rewrite configurations. Pair with access-log URI anomaly rules on internet-facing NGINX.
Detects launching shells with history disabled via environment variables (separate from deleting history files),
consistent with impairing command history logging (Defense Evasion).
consistent with impairing command history logging (Defense Evasion).
Hidden User Use Case Monitors dslocal user plist modifications for IsHidden, indicating a concealed local account created or modified outside standard account management workflows.
Detects the use of curl to download files from Telegram to local temp folder, which may indicate initial malware staging.
Detects attempts to disable Gatekeeper assessment or modify System Integrity
Protection, common defense evasion before unsigned payload execution.
Protection, common defense evasion before unsigned payload execution.
Detects enabling Hide500Users in com.apple.loginwindow plist preferences, which suppresses
sub-500 UID accounts from the login screen and System Settings.
sub-500 UID accounts from the login screen and System Settings.
Detects hiding a user home folder with chflags, complementing account-level hiding
documented in T1564.002.
documented in T1564.002.
This rule detects crashes in Nginx worker processes, specifically looking for messages indicating a 'signal 11' or 'SIGSEGV' error. This could be indicative of a vulnerability being exploited (e.g., CVE-2026-42945) or other critical software malfunctions.
Detects hiding a user home folder with chflags, complementing account-level hiding, documented in T1564.002.
Detects commands that clear interactive shell history or disable history persistence,
consistent with Defense Evasion (impairing command history visibility).
consistent with Defense Evasion (impairing command history visibility).
Page 15 of 38