Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
17 detections
Filters
Last updated
All Time
Detection languages
10
2
2
1
1
Contributors
4
3
3
2
1
Categories
6
6
5
5
4
Platforms
15
2
Products / Services
6
2
1
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
2
IDS Protocols
1
1
This rule detects malicious activity associated with the Bazinga macOS backdoor, specifically focusing on the clearing of TCC privacy permissions, the staging of keychain and browser data using 'ditto', and the subsequent exfiltration of this data to a remote host via 'curl'.
This rule detects malicious activity associated with the Bazinga macOS backdoor, specifically focusing on the clearing of TCC privacy permissions, the staging of keychain and browser data using 'ditto', and the subsequent exfiltration of this data to a remote host via 'curl'.
This rule detects malicious activity associated with the Bazinga macOS backdoor, specifically focusing on the clearing of TCC privacy permissions, the staging of keychain and browser data using 'ditto', and the subsequent exfiltration of this data to a remote host via 'curl'.
Detects sequential Transparency, Consent, & Control (TCC) permission prompts triggered by the 'Terminal' application within a 5-minute window. This behavior is indicative of the AMOS (Atomic macOS) Stealer automating the collection of unauthorized permissions to access sensitive system locations such as Finder, Desktop, Documents, and Notes.
This rule detects malicious activity associated with the Bazinga macOS backdoor, specifically focusing on the clearing of TCC privacy permissions, the staging of keychain and browser data using 'ditto', and the subsequent exfiltration of this data to a remote host via 'curl'.
Detects modifications to the Transparency, Consent, and Control (TCC) database on macOS. The rule categorizes activity based on the file path (system-wide or user-specific) and the user account performing the modification, identifying potentially unauthorized changes to application privacy permissions.
Detects unauthorized attempts to modify or interact with the macOS Transparency, Consent, and Control (TCC) database. This includes direct file system modifications by non-system processes, sqlite-based manipulation of the TCC database, or the usage of 'tccutil' to reset permissions. These behaviors are often indicative of malware attempting to silently elevate privileges or grant itself Full Disk Access to sensitive user data.
Detects modification of macOS TCC database to grant unauthorized permissions
This rule detects the delivery of a payload designed to bypass macOS Transparency, Consent, and Control (TCC) mechanisms via HTTP. Specifically, it looks for the string "kTCCServiceCamera" within HTTP response data, indicating an attempt to manipulate camera access permissions. This activity is often associated with privilege escalation techniques on macOS.
This rule detects attempts to modify the macOS Transparency, Consent, and Control (TCC) database over an SSH connection. The TCC database stores user privacy settings, and its modification can indicate an attempt to bypass security controls or escalate privileges. The rule specifically looks for the string "TCC.db" within TCP traffic directed to port 22 (SSH).
Detects the renaming of the macOS TCC (Transparency, Consent, and Control) directory. This is a specific evasion technique where malware renames the directory to 'com.appled.tcc' to release file locks on the TCC.db, allowing for the injection of permissions.
Detects malicious activity related to the TCC.db, commonly abused by macOS malware
to bypass Transparency, Consent, and Control (TCC) restrictions.
to bypass Transparency, Consent, and Control (TCC) restrictions.
Detects malicious activity related to the TCC.db, commonly abused by macOS malware to bypass Transparency, Consent, and Control (TCC) restrictions.
Detects the creation or modification of an unsigned Spotlight importer (.mdimporter) bundle within a user's Library/Spotlight directory on macOS. This activity is indicative of the Sploitlight TCC bypass technique (CVE-2025-31199), where an attacker leverages a malicious, unsigned importer to gain unauthorized access to TCC-protected data via the mds/mdworker processes.
Detects the creation of a Spotlight importer bundle (.mdimporter) in a user's Library directory. This is a key step in the Sploitlight TCC bypass technique (CVE-2025-31199), where an attacker places a malicious importer to be executed with elevated privileges by the mds_stores process, allowing unauthorized access to TCC-protected data.
KQL Query
Jupyter, otherwise known as SolarMarker, is a malware family and cluster of components known for its info-stealing and backdoor capabilities that mainly proliferates through search engine optimization manipulation and malicious advertising in order to successfully encourage users to download malicious templates and documents. This malware has been popular since 2020 and currently is still active as of 2021.
