Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4 detections
Filters
Last updated
All Time
Detection languages
2
1
1
Contributors
2
1
1
Categories
3
1
1
1
1
Platforms
2
1
1
Products / Services
2
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
This rule detects repeated attempts to use the 'dscl' utility on macOS with the 'authonly' flag within a short timeframe, which is a known indicator of credential validation loops often used by backdoors like Bazinga. The detection also looks for correlations with suspicious 'osascript' system preference prompts and the creation of '.passphrase' files to identify potential automated credential theft activity.
Sudo Caching and Elevation Abuse
Gravwell
Detects attempts to abuse sudo and sudo caching mechanisms by modifying the /etc/sudoers file to disable tty_tickets, add NOPASSWD entries. This behavior is associated with malware like Proton and Dok to escalate privileges.
Detects attempts to abuse sudo and sudo caching mechanisms by modifying the /etc/sudoers file to disable tty_tickets, add NOPASSWD entries. This behavior is associated with malware like Proton and Dok to escalate privileges.
KQL Query from file: Tracking Proton66 Activity with KQL
