Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
1
1
1
Contributors
2
1
Categories
2
1
1
1
1
Platforms
3
1
Products / Services
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
Detects abuse of macOS XPC services for inter-process execution
This rule detects potential macOS XPC Service abuse via remote SSH. Specifically, it looks for TCP traffic on port 22 (SSH) within the home network that contains the strings "launchctl" and "submit" (case-insensitive). This combination suggests an attempt to use the launchctl command to submit a job, potentially exploiting XPC services, over an SSH connection.
Detects the interaction with macOS XPC services such as 'nsurlstoraged' and 'CoreSpotlightService' via 'xpcproxy'. This technique is used by malware like AMOS and Odyssey Stealer to blend malicious activity with legitimate system processes for stealth and persistence.
