Danny Y
@zendannyyTrusted contributorCompletionist
3 followers3,372 downloads955 copies13 likes34,081 views
375 detections
Filters
Last updated
All Time
Detection languages
217
71
32
20
11
Categories
211
89
31
25
19
Platforms
169
148
32
12
9
Products / Services
57
49
47
14
12
MITRE Techniques
152
109
107
75
34
CVEs
2
1
1
1
1
Detects delete/create sequences on the same /Users/ path within a short time window,
consistent with account attribute laundering during hidden user setup.
consistent with account attribute laundering during hidden user setup.
Detects a Node.js or npm process attempting to read sensitive credential files such as SSH keys, npm tokens, K8s configurations, cloud credentials, or Vault material. This rule is tuned for the Red Hat Cloud Services supply chain attack by monitoring for Node.js/npm processes executing in the context of the affected packages or preinstall hooks.
Detects post-install execution of the TeamPCP-compromised Microsoft durabletask package
(v1.4.1–1.4.3, May 2026). The worm drops rope.pyz/managed.pyz, marks infection via
~/.cache/.sys-update-check, persists as pgsql-monitor.service, and then propagates via AWS SSM
and kubectl exec.
(v1.4.1–1.4.3, May 2026). The worm drops rope.pyz/managed.pyz, marks infection via
~/.cache/.sys-update-check, persists as pgsql-monitor.service, and then propagates via AWS SSM
and kubectl exec.
Detects activity where one K8s client accesses many secrets in a short span.
This could be indicative of Credential access, working towards Privilege Escalation.
This could be indicative of Credential access, working towards Privilege Escalation.
Detects attempts to disable Gatekeeper assessment or modify System Integrity
Protection, common defense evasion before unsigned payload execution.
Protection, common defense evasion before unsigned payload execution.
Detects attempts to disable Gatekeeper assessment or modify System Integrity
Protection, common defense evasion before unsigned payload execution.
Protection, common defense evasion before unsigned payload execution.
Detects active SSH session takeover attempts.
When the process of one user accesses another user's SSH agent
When the process of one user accesses another user's SSH agent
Detects enabling Hide500Users in com.apple.loginwindow preferences, which suppresses
sub-500 UID accounts from the login screen and System Settings.
sub-500 UID accounts from the login screen and System Settings.
Process Creation of LOLRMM Tools
Gravwell
Detects process creation for common RMM tools.
The idea here would be to alert on non approved RMM tools, and anything outside of the one or few approved tools would be suspicious/malicious.
The idea here would be to alert on non approved RMM tools, and anything outside of the one or few approved tools would be suspicious/malicious.
Detects uncommon or suspicious child processes spawning from a VsCode process. This could indicate an attempt of persistence via VsCode tasks or terminal profiles.
Page 16 of 38