Suspicious macOS Firmware Password Activity
Detects when the 'firmwarepasswd' utility is executed on macOS with commands to set, delete, or check the firmware password. This activity can indicate an attempt to manipulate the system's firmware security settings, potentially for malicious purposes such as preventing unauthorized OS installations or recovery, or to lock out legitimate users. The rule notes that this command is disabled on Apple Silicon-based Macs.
Sigma
