Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
128 detections
Filters
Last updated
All Time
Detection languages
74
35
16
3
Contributors
128
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
98
28
3
Products / Services
55
14
10
8
7
MITRE Techniques
82
33
30
23
11
CVEs
4
4
1
Detects short-lived execution of the compiled AppleScript loader from /tmp/p.app, correlated with its rapid creation-then-deletion pattern, the observable proxy for XCSSET's dual-key-encrypted loader architecture.
Detects XCSSET's settings_app module installing LaunchDaemon-based persistence via a fake Settings.app located outside standard system paths, which also blocks XProtect features.
Page 7 of 7