Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
30 detections
Filters
Last updated
All Time
Detection languages
15
8
2
2
1
Contributors
5
4
4
4
3
Categories
16
10
9
4
3
Platforms
30
1
Products / Services
10
1
1
1
1
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
2
IDS Classtypes
1
IDS Protocols
1
CVE-2026-65400 affects the macOS Screen Sharing service and can allow an attacker on the network to authenticate without valid credentials. Huntress' research goes further, describing the pre-authentication path and opportunities to obtain root-level file access and ultimately code execution. First thing first: patch. Update affected devices to macOS Tahoe 26.6.1, Sequoia 15.7.9, or Sonoma 14.8.9. Apple released these versions on August 6 to address CVE-2026-65400. If patching is not immediately possible, disable Screen Sharing. After patching, we still need to answer the hunter's question: was any of this activity already happening before the update? The KQL below hunts across Microsoft Defender XDR telemetry for activity around the observed attack path: Screen Sharing file activity, SSH sessions, privileged file writes, LaunchDaemon persistence, process masquerading, Packet Filter changes, XMRig artefacts and related network activity. One process particularly worth reviewing is SSFileCopyReceiver / SSFileCopySender. Huntress notes that these are privileged Screen Sharing helpers, and their research highlights root-context activity and filesystem operations as useful hunting opportunities.
Detects creation of LaunchAgent/LaunchDaemon plists, /etc/zshenv, or SSH authorized_keys attributed to screensharingd/helpers or occurring within a Screen Sharing session window — persistence via the root file-write primitive.
Detects the creation of .plist files in sensitive directories used by macOS launchd for automatic execution (LaunchAgents and LaunchDaemons). Adversaries use these locations to establish persistence by ensuring malicious code or scripts are executed at startup or upon user login.
Detects a LaunchDaemon plist named to impersonate Apple's crash reporter, staged at /tmp/starter before being moved into /Library/LaunchDaemons and bootstrapped via launchctl, matching AmnesiaStealer's persistence mechanism.
Detects osascript process execution spawned by launchd/LaunchAgent chains where the invoked AppleScript command line contains obfuscated/encoded content, consistent with EtherHiding's Launch Agent-triggered AppleScript payloads used to query blockchain C2 infrastructure.
Detects XCSSET's settings_app module installing LaunchDaemon-based persistence via a fake Settings.app located outside standard system paths, which also blocks XProtect features.
Detects XCSSET's settings_app module installing LaunchDaemon-based persistence via a fake Settings.app located outside standard system paths, which also blocks XProtect features.
Detects the creation of plist files within macOS /Library/LaunchAgents/ or /Library/LaunchDaemons/ directories by the osascript utility. This behavior is indicative of Meow RAT establishing persistence by masquerading as a legitimate system service.
Detects the creation or modification of suspicious LaunchAgent or LaunchDaemon plist files on macOS. Specifically looks for files named 'com.apple.accountsd.plist' or files within a hidden directory '.com.apple.accountsd' in common LaunchAgent/Daemon paths. This pattern is often used by malware for persistence.
Detects the creation or modification of suspicious Launch Agent or Launch Daemon .plist files, or a hidden application support directory, masquerading as 'com.apple.accountsd' on macOS. This behavior is often indicative of persistence mechanisms used by adversaries.
This rule detects the creation or modification of specific Launch Agent or Launch Daemon plist files on macOS, particularly those masquerading as 'com.apple.accountsd'. It also identifies the creation of a hidden directory '.com.apple.accountsd' within '/Library/Application Support'. This activity is highly suspicious as it indicates an attempt to establish persistence or execute malicious code by mimicking legitimate system services.
Detects deployment of malicious LaunchDaemon plist files for privileged persistence
Detects the creation of the .agent shell wrapper file designed to supervise and restart the .mainhelper backdoor process.
Detects the creation, modification, or renaming of the 'com.finder.helper.plist' file in the '/Library/LaunchDaemons/' directory, which is a specific persistence mechanism used by the AMOS stealer malware. This rule specifically targets the root-level persistence method.
Detects creation of macOS Launch Agent plist files for persistence
This rule detects the delivery of a macOS Launch Daemon Property List (.plist) file via HTTP. Attackers often use Launch Daemons for persistence on macOS systems. The rule specifically looks for HTTP traffic containing '.plist' in the URI and 'LaunchDaemon' within the file data, indicating a potential attempt to establish persistence.
Detects the use of launchctl submit to establish persistence on macOS.
Unlike the more common LaunchAgent/LaunchDaemon plist approach, launchctl
submit registers a job directly via the command line without creating a
plist file on disk, making it harder to discover through filesystem
sweeps. This technique is used by JINX-0164 (Wiz CIRT) to persist
AUDIOFIX and MINIRAT payloads with job labels like chrome.job and
coreaudio.job, but the technique itself is rare in legitimate software.
The rule catches any launchctl submit invocation and flags known
JINX-0164 job labels for high-confidence triage.
Unlike the more common LaunchAgent/LaunchDaemon plist approach, launchctl
submit registers a job directly via the command line without creating a
plist file on disk, making it harder to discover through filesystem
sweeps. This technique is used by JINX-0164 (Wiz CIRT) to persist
AUDIOFIX and MINIRAT payloads with job labels like chrome.job and
coreaudio.job, but the technique itself is rare in legitimate software.
The rule catches any launchctl submit invocation and flags known
JINX-0164 job labels for high-confidence triage.
This rule detects suspicious Launch Daemons on macOS by looking for files created or modified in the `/Library/LaunchDaemons/` directory. It filters out known legitimate binaries and then flags any remaining files that have low global prevalence (less than 2500 instances) and were first seen more than 90 days ago. Additionally, it checks if the certificate is invalid or not signed by Microsoft, indicating potential malicious activity. This rule is intended for hunting and not for direct alerting due to the need for whitelisting.
Detects the creation or modification of .plist files in macOS Launch Agent and Launch Daemon directories. This activity can be indicative of persistence mechanisms being established by adversaries. The rule excludes modifications by common system installers to reduce false positives.
This rule detects the use of the PlistBuddy utility to modify LaunchAgents or LaunchDaemons on macOS. Specifically, it looks for command-line arguments that include 'RunAtLoad' and 'true', along with either 'LaunchAgents' or 'LaunchDaemons', indicating an attempt to establish persistence by configuring a program to run automatically at system startup or user login.
Detects the execution of programs as Launch Agents or Launch Daemons using the `launchctl` command on macOS. This activity can be indicative of persistence mechanisms established by adversaries.
Page 1 of 2