Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
51 detections
Filters
Last updated
All Time
Detection languages
26
12
3
3
2
Contributors
11
7
5
4
4
Categories
36
23
22
5
4
Platforms
44
4
1
1
Products / Services
31
5
3
2
2
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
CVEs
1
IDS Classtypes
1
IDS Protocols
1
Detects the navi_the_clown macOS Screen Sharing pre-auth RCE PoC binary via hash/filename/command-line flag or, as a lower-confidence secondary indicator, codesign+xattr Gatekeeper-bypass staging correlated with the PoC filename or flags
Detects ad-hoc code-signing or quarantine-attribute removal on a binary delivered via the Screen Sharing file-copy channel or another network delivery within the preceding 30 minutes, indicating Gatekeeper-bypass preparation of a downloaded exploit tool.
This rule detects potential attempts to bypass macOS Gatekeeper security checks by identifying the removal of the 'com.apple.quarantine' extended attribute using the 'xattr' utility, or by changing file permissions using 'chmod' on files marked with the 'com.apple.verified' attribute. Adversaries use these techniques to ensure malicious or untrusted binaries execute without user prompts or security warnings.
This rule detects suspicious activity involving the modification of file attributes on macOS, specifically targeting the removal of the 'com.apple.quarantine' extended attribute and the manipulation of files associated with 'com.apple.trustd'. Such actions are indicative of an adversary attempting to bypass Gatekeeper security controls or execute masqueraded payloads by stripping quarantine flags or modifying execution permissions.
Detects the execution of the xattr command with the '-cr' flags on macOS. This combination is commonly used to recursively remove the com.apple.quarantine extended attribute from files and directories, which effectively bypasses macOS Gatekeeper security checks for downloaded applications or files.
Detects a sequence of actions on macOS where an attacker removes the quarantine extended attribute (com.apple.quarantine) using 'xattr' and subsequently performs ad-hoc code signing using 'codesign' on the same system. This behavior is indicative of an attempt to bypass macOS Gatekeeper security controls to execute untrusted or malicious binaries.
Detects the 'codesign' utility being invoked with flags '-fs' (force sign) and '--deep' (recursively sign) triggered by a shell process spawned from 'Script Editor'. This pattern is often used to bypass macOS Gatekeeper or attempt to re-sign malicious applications after tampering.
Detects the use of 'codesign' by 'Script Editor' on macOS to sign files within the '/Library/Application Support/' directory. This behavior is indicative of potential malicious activity, such as attempting to bypass Gatekeeper or signing tampered application files to maintain persistence or evade security controls.
Detects the AMOS (Atomic macOS Stealer) infection chain where a shell (e.g., Terminal, bash) executes curl to download a DMG file to a temporary directory, followed immediately by the use of hdiutil with the -nobrowse flag to mount the disk image silently, effectively bypassing macOS Gatekeeper UI prompts to the user.
Detects potential malware execution chains characteristic of AMOS (Atomic macOS Stealer) and related 'ClickFix' campaigns. The rule monitors for the silent downloading of a disk image (.dmg) file to the /tmp directory using curl with quiet flags, followed immediately by the mounting of that image using hdiutil with the -nobrowse flag to bypass user notification and Gatekeeper security prompts.
Detects fragmented string reconstruction techniques within PowerShell memory targeting IWR (Invoke-WebRequest) or IEX (Invoke-Expression). This rule specifically looks for PowerShell process command lines containing 'IWR' or 'IEX' with fragmented string obfuscation (e.g., I['']w['']r).
Detects attempts to bypass macOS Gatekeeper security controls
This rule detects attempts to bypass macOS Gatekeeper by removing the 'com.apple.quarantine' extended attribute from downloaded files. It specifically looks for HTTP responses containing the string 'com.apple.quarantine' in the file data, indicating a potential attempt to modify or remove this attribute during or after a download.
Detects attempts to disable Gatekeeper assessment or modify System Integrity
Protection, common defense evasion before unsigned payload execution.
Protection, common defense evasion before unsigned payload execution.
Detects attempts to disable Gatekeeper assessment or modify System Integrity
Protection, common defense evasion before unsigned payload execution.
Protection, common defense evasion before unsigned payload execution.
Detects attempts to disable Gatekeeper assessment or modify System Integrity
Protection, common defense evasion before unsigned payload execution.
Protection, common defense evasion before unsigned payload execution.
Detects macOS Gatekeeper bypass via xattr utility
Detects attempts to manually remove the Apple quarantine extended
attribute using the xattr utility. This technique is often used by malware,
such as the notnullOSX stealer, to bypass macOS Gatekeeper protections on
downloaded payloads.
attribute using the xattr utility. This technique is often used by malware,
such as the notnullOSX stealer, to bypass macOS Gatekeeper protections on
downloaded payloads.
Detects the execution of a curl command downloading a shell script (.sh) directly into the /var/tmp/ directory. This technique is actively used in ClickFix social engineering campaigns, such as "Contagious Interview," where attackers manipulate developers into pasting malicious commands into the macOS Terminal to bypass Gatekeeper protections.
Detects execution of shell scripts from mounted disk images (DMG), a technique
used to bypass Gatekeeper restrictions after macOS Sequoia updates.
used to bypass Gatekeeper restrictions after macOS Sequoia updates.
Detects the execution of the 'xattr -c' command on a macOS endpoint. This command is used to clear all extended attributes from a file, including the 'com.apple.quarantine' attribute set by Gatekeeper on downloaded files. UNC5142 uses this technique to bypass macOS security prompts before executing downloaded malware like the ATOMIC infostealer.
Page 2 of 3