Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
112 detections
Filters
Last updated
All Time
Detection languages
68
19
8
8
4
Contributors
20
17
16
11
8
Categories
62
59
41
28
18
Platforms
105
6
4
2
1
Products / Services
55
6
4
4
3
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
2
1
IDS Classtypes
1
IDS Protocols
1
Detects the creation or modification of specific LaunchAgent plist files used by the arm64 and x86_64 variants of SStar Agent malware on macOS for persistence. The rule looks for file events (creation, modification, rename) within the /Library/LaunchAgents/ directory, specifically targeting 'com.wpnuersvc.agent.plist' and 'com.googleupdate.sstaragent.plist' filenames.
Detects the creation or modification of specific LaunchAgent plist files used by JINX-0164's AUDIOFIX and MINIRAT malware for persistence on macOS. The rule monitors for file creation, renaming, or modification events within the /Library/LaunchAgents/ directory, specifically targeting plist files with names known to be used by this malware.
Detects the execution of 'launchctl submit' with specific job names ('chrome.job' or 'coreaudio.job') that have been observed in JINX-0164 macOS campaigns to establish persistence.
Detects the creation of an unexpected LaunchAgent property list named 'com.google.keystone.agent.plist' paired with the creation or execution of a binary at '~/Library/Application Support/Google/GoogleUpdate.app/Contents/MacOS/GoogleUpdate'. This exact path and plist combination is used by the SHub Reaper malware to establish persistent backdoor access while masquerading as a Google software update.
Detects the creation of the specific LaunchAgent plist file (com.vfrfeufhtjpwgray.plist) used by the macOS execution chain for persistence in the REF6598 campaign delivering PHANTOMPULSE RAT.
Detects the creation of the specific LaunchAgent plist file ('com.vfrfeufhtjpwgray.plist') used by the macOS AppleScript dropper in the REF6598 campaign for persistence, ensuring visibility into the non-Windows infection chain.
Identifies the creation of a specific LaunchAgent plist file associated with the PhantomPulse macOS AppleScript dropper, indicating persistence on macOS systems.
This rule detects potential persistence mechanisms used by the AMOS malware on macOS systems. Specifically, it looks for the creation or execution of a launch daemon named 'com.finder.helper' in conjunction with other suspicious activities such as the execution of '.agent' or '.mainhelper' files, or commands used for user context pivoting . The rule also includes checks for VM detection attempts using 'system_profiler'. This combination of activities indicates a high likelihood of AMOS malware establishing persistence and attempting to escalate privileges or gather system information.
This rule detects activity related to OpenClaw, Clawdbot, and Moltbot, including their known aliases (clawd, molty, clawhub). Detection is based on several indicators: specific command-line arguments used with common scripting/execution environments (node, npm, bun, pnpm, bash, sh, zsh, launchd, env, curl, pwsh, powershell), presence of specific install or data directories (e.openclaw, .moltbot, .clawdbot, /clawd/, .molty), macOS LaunchAgent persistence mechanisms (ai.openclaw.gateway.plist, bot.molt., com.openclaw.gateway.plist, /Applications/OpenClaw.app), and the use of specific configuration file names (openclaw.json, moltbot.json, clawdbot.json, clawd.json) or aliases (molty, clawhub) within process display names or names.
Detects the creation of a macOS Launch Agent by a suspicious process or with a name matching patterns used by the BlueNoroff group. BlueNoroff uses Launch Agents for persistence on compromised macOS systems.
Detects the execution of shell scripts and creation of files associated with the FlexibleFerret macOS malware campaign, which is tied to fake job recruitment lures to trick users into executing malicious commands.
Detects creation of FlexibleFerret persistence mechanism via LaunchAgent plist in macOS.
Detects command line creation or loading of suspicious LaunchAgent plists related to FlexibleFerret malware on macOS.
Detects the creation or modification of .plist files in macOS Launch Agent and Launch Daemon directories. This activity can be indicative of persistence mechanisms being established by adversaries. The rule excludes modifications by common system installers to reduce false positives.
Detects the creation of a Launch Agent .plist file used by the DigitStealer malware. This Launch Agent dynamically retrieves its payload from a DNS TXT record, a technique used for resilient persistence.
This rule detects the use of the PlistBuddy utility to modify LaunchAgents or LaunchDaemons on macOS. Specifically, it looks for command-line arguments that include 'RunAtLoad' and 'true', along with either 'LaunchAgents' or 'LaunchDaemons', indicating an attempt to establish persistence by configuring a program to run automatically at system startup or user login.
Detects the execution of programs as Launch Agents or Launch Daemons using the `launchctl` command on macOS. This activity can be indicative of persistence mechanisms established by adversaries.
This rule detects the use of 'launchctl load -w' commands on macOS systems, which is a common method for establishing persistence by loading Launch Agents or Daemons. It specifically looks for process creation events where 'launchctl' is involved with the 'load -w' parameters, while excluding known legitimate processes from Palo Alto Networks, Apple, Zscaler, Adobe, Citrix, Microsoft, Netskope, Red Giant, and Logitech to reduce false positives.
Detects the execution of programs as Launch Agents or Launch Daemons using launchctl on macOS.
Detects potential persistence activity using LaunchAgents or LaunchDaemons via the PlistBuddy utility
Detects various techniques, procedures, and indicators associated with the RustyPages macOS malware dropper, including persistence, defense evasion, payload download, and known IOCs. This rule specifically looks for the use of `curl` to download a hidden file, `launchctl` to establish persistence, `chmod` to make the payload executable, `xattr` to clear extended attributes, `pgrep` to discover security tools, shell commands to silence notifications, C2 domain/IP connections, and known malware file hashes.
Page 5 of 6