macOS Login Item Added for Persistence

Darshan Thummar@Mighty

•updated Jun 11, 2026•1•0•5

This rule detects network traffic containing the string "LSSharedFileList" (case-insensitive) on TCP port 22 (SSH). This string is associated with macOS Login Items, which can be used for persistence by adversaries. The rule specifically looks for this content in traffic flowing from the client to the server.