Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
51 detections
Filters
Last updated
All Time
Detection languages
26
12
3
3
2
Contributors
11
7
5
4
4
Categories
36
23
22
5
4
Platforms
44
4
1
1
Products / Services
31
5
3
2
2
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
CVEs
1
IDS Classtypes
1
IDS Protocols
1
Detects malicious Spotlight Importer (.mdimporter) files designed to bypass macOS TCC protections, as seen in the 'Sploitlight' exploit (CVE-2025-31199). The rule identifies importers that read a file's contents and leak them via logging.
KQL Query from file: Fortigate Belsen Leak KQL Check
KQL Query from file: defendnot detection
KQL Query from file: MDE KQL to detect UAC bypass of Fickle Stealer
This query visualises total emails with Malware detections over time summarizing the data daily by Delivery Location.
Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_apt29_thinktanks.yml.
Questions via Twitter: @janvonkirchheim.
Questions via Twitter: @janvonkirchheim.
The analytic identifies the use of `sqlite3` querying the MacOS preferences to determine the original URL from which a package was downloaded. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions involving `LSQuarantine`. This activity is significant as it is commonly associated with MacOS adware and other malicious software. If confirmed malicious, this behavior could indicate an attempt to track or manipulate downloaded packages, potentially leading to further system compromise or persistent adware infections.
This rule detects attempts to disable security tools on macOS systems. It specifically looks for the use of '/bin/launchctl' to 'unload' security-related plists (property list files) associated with common security software like Objective-See's LuLu and BlockBlock, Google Santa, Carbon Black, Little Snitch, Tenable Nessus, OpenDNS Umbrella, Crowdstrike Falcon, osquery, Filebeat, Auditbeat, Packetbeat, and td-agent. Additionally, it detects attempts to disable macOS Gatekeeper using '/usr/sbin/spctl' with the 'disable' argument.
This rule detects attempts to bypass macOS Gatekeeper by removing the 'com.apple.quarantine' extended attribute from a file using the 'xattr' utility. This action prevents Gatekeeper from performing its security checks on the file, allowing untrusted applications to execute without user prompts.
Page 3 of 3