Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
14 detections
Filters
Last updated
All Time
Detection languages
6
5
2
1
Contributors
4
3
1
1
1
Categories
11
5
2
2
1
Platforms
13
2
1
1
Products / Services
3
2
2
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
1
IDS Protocols
1
1
Detects behaviors associated with AMOS and Odyssey Stealer, including using osascript to perform anti-analysis checks via system_profiler and terminating OneDrive services to impair defenses.
Detects the use of 'launchctl load' to activate the gh-token-monitor LaunchAgent persistence mechanism immediately after creation.
Detects abuse of macOS XPC services for inter-process execution
Detects launchctl used to load services for macOS persistence or execution
This rule detects when a file containing both ".plist" in its HTTP URI and "LaunchDaemon" in its content is delivered via HTTP. This combination suggests the download of a macOS LaunchDaemon property list file, which could be used for persistence or privilege escalation on macOS systems.
This rule detects the string "launchctl load" within TCP traffic on port 22 (SSH). This indicates an attempt to load a launchd service on a macOS or Linux system via a remote SSH connection. This activity could be legitimate system administration but also could be indicative of an attacker establishing persistence or executing malicious services.
Detects the execution of 'launchctl submit' with specific job names ('chrome.job' or 'coreaudio.job') that have been observed in JINX-0164 macOS campaigns to establish persistence.
This rule detects the installation and activation of the ClawdBot extension, likely within Visual Studio Code. It looks for the creation of specific files (extension.js, package.json, run.bat) within known VS Code extension paths and correlates this with the execution of 'Code.exe' or 'code.exe'. The rule specifically triggers when at least two of these files are found in the specified paths, indicating a potential extension installation.
Detects behaviors associated with AMOS and Odyssey Stealer, including using osascript to perform anti-analysis checks via system_profiler and terminating OneDrive services to impair defenses.
Detects the execution of programs as Launch Agents or Launch Daemons using the `launchctl` command on macOS. This activity can be indicative of persistence mechanisms established by adversaries.
This rule detects the use of 'launchctl load -w' commands on macOS systems, which is a common method for establishing persistence by loading Launch Agents or Daemons. It specifically looks for process creation events where 'launchctl' is involved with the 'load -w' parameters, while excluding known legitimate processes from Palo Alto Networks, Apple, Zscaler, Adobe, Citrix, Microsoft, Netskope, Red Giant, and Logitech to reduce false positives.
Detects the execution of programs as Launch Agents or Launch Daemons using launchctl on macOS.
This query was originally published in the threat analytics report, EvilQuest signals the rise of Mac ransomware.
As of the time of this writing (October 2020), ransomware designed to target macOS is relatively rare. EvilQuest is one of the few examples of this kind of malware on the platform.
The query below can detect events associated with the launch of the EvilQuest executable, questd, from the shell.
Other queries related to EvilQuest ransomware can be found under the See also section below.
As of the time of this writing (October 2020), ransomware designed to target macOS is relatively rare. EvilQuest is one of the few examples of this kind of malware on the platform.
The query below can detect events associated with the launch of the EvilQuest executable, questd, from the shell.
Other queries related to EvilQuest ransomware can be found under the See also section below.
This rule detects attempts to disable security tools on macOS systems. It specifically looks for the use of '/bin/launchctl' to 'unload' security-related plists (property list files) associated with common security software like Objective-See's LuLu and BlockBlock, Google Santa, Carbon Black, Little Snitch, Tenable Nessus, OpenDNS Umbrella, Crowdstrike Falcon, osquery, Filebeat, Auditbeat, Packetbeat, and td-agent. Additionally, it detects attempts to disable macOS Gatekeeper using '/usr/sbin/spctl' with the 'disable' argument.