Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
90 detections
Filters
Last updated
All Time
Detection languages
30
29
10
6
6
Contributors
21
16
10
6
6
Categories
57
50
43
13
13
Platforms
87
4
4
3
Products / Services
38
6
4
3
3
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
CVEs
1
1
IDS Classtypes
2
IDS Protocols
1
1
This rule detects attempts to collect data from the clipboard on macOS systems by executing the 'osascript' binary with arguments that indicate clipboard interaction. Specifically, it looks for command lines containing 'osascript', ' -e ', and 'clipboard'. This combination suggests an AppleScript or JavaScript for Automation (JXA) command being executed to access clipboard contents.
This rule detects the execution of 'osacompile' with the '-x' and '-e' flags, which indicates the compilation of a run-only AppleScript. Run-only AppleScripts are compiled scripts that cannot be easily decompiled or inspected, making them a potential method for adversaries to obfuscate malicious code and evade analysis. The '-x' flag compiles the script as execute-only, and '-e' specifies the script source.
Detects suspicious child processes spawning from Microsoft Office suite applications (Word, Excel, PowerPoint, OneNote) on macOS. This behavior often indicates malicious macro execution attempting to leverage scripting interpreters or command-line utilities for further compromise.
This rule detects the execution of AppleScript or JavaScript for Automation (JXA) scripts on macOS systems. It specifically looks for the 'osascript' utility being used with command-line arguments that indicate direct script execution ('-e') or the execution of script files with '.scpt' (AppleScript) or '.js' (JavaScript/JXA) extensions. This activity can be indicative of an adversary using scripting interpreters for execution.
Detects suspicious child processes spawning from microsoft office suite applications such as word or excel. This could indicates malicious macro execution
Detects potential suspicious applet or osascript executing "osacompile".
Page 5 of 5