Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8 detections
Filters
Last updated
All Time
Detection languages
5
1
1
1
Contributors
3
2
1
1
1
Categories
6
6
3
2
1
Platforms
6
2
Products / Services
6
1
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
1
IDS Protocols
1
Detects coordinated usage of 'xattr' to manipulate the com.apple.quarantine attribute and 'chmod' to grant executable permissions on sensitive macOS system or library paths. This behavior is indicative of an adversary attempting to bypass Gatekeeper or bypass execution restrictions on malicious payloads placed in system directories.
Detects attempts to bypass macOS Gatekeeper security controls by either removing the quarantine extended attribute or marking a file as executable using 'xattr' or 'chmod'. These techniques are used to allow untrusted or malicious applications to execute without user authorization.
This rule detects the use of the macOS 'xattr' command to remove the 'com.apple.quarantine' extended attribute from files located within '/Library/Application Support/iCloudsync/'. This action is typically performed to bypass macOS Gatekeeper security checks, allowing untrusted binaries or payloads to execute without user confirmation or security prompts.
This rule detects the use of the macOS 'xattr' command to remove the 'com.apple.quarantine' extended attribute from files located within '/Library/Application Support/iCloudsync/'. This action is typically performed to bypass macOS Gatekeeper security checks, allowing untrusted binaries or payloads to execute without user confirmation or security prompts.
This rule detects attempts to bypass macOS Gatekeeper security controls by disabling security policies via the 'spctl' command, or by removing file quarantine attributes using the 'xattr' utility. These techniques are commonly used to execute unauthorized or malicious software that would otherwise be blocked by macOS security features.
This rule detects suspicious activity involving the modification of file attributes on macOS, specifically targeting the removal of the 'com.apple.quarantine' extended attribute and the manipulation of files associated with 'com.apple.trustd'. Such actions are indicative of an adversary attempting to bypass Gatekeeper security controls or execute masqueraded payloads by stripping quarantine flags or modifying execution permissions.
Detects use of Linux extended attributes to hide malicious data
This rule detects the string "setfattr" in TCP traffic destined for port 22 (SSH). The presence of "setfattr" in SSH traffic might indicate an attempt to use Linux extended attributes to hide data or malicious payloads, a technique often associated with defense evasion.