File and Directory Discovery - macOS Utilities
This rule detects the usage of common macOS command-line utilities for file and directory discovery. Specifically, it looks for executions of '/usr/bin/file' with a very long command line (potentially indicating wildcard usage), '/bin/ls' with the recursive flag '-R', and direct executions of '/usr/bin/find' and '/usr/bin/mdfind'. It also includes a generic detection for '/tree' which might be a custom or less common utility for directory listing.
Sigma
