Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1 detection
Filters
Last updated
All Time
Detection languages
1
Contributors
1
Categories
1
1
1
Platforms
1
Products / Services
1
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
This rule detects attempts by common scripting or utility processes (like osascript, curl, zsh, bash, sh, python) to access sensitive macOS files, specifically targeting browser data (Chrome, Brave, Firefox) and keychain files. This activity could indicate an attacker attempting to exfiltrate credentials, session tokens, or other sensitive user data.
