Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
19 detections
Filters
Last updated
All Time
Detection languages
16
2
1
Contributors
10
4
2
1
1
Categories
19
11
8
5
3
Platforms
19
Products / Services
13
2
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
2
IDS Protocols
1
1
This rule detects suspicious activity involving macOS LaunchAgents and files within the 'Application Support/System' directory, often associated with persistence or malicious background execution. The detection looks for the creation or modification of specific plist files (e.g., com.apple.finder.agent.plist) or git-related files in Application Support, correlated with process execution of commands like 'sysnotif-repair', 'launchctl' manipulating agents, or git operations involving custom hooks paths.
Detects unauthorized modifications to the 'endo_voyager_dictation_endpoint' preference key within the 'com.meta.muse.plist' file on macOS. This key is an undocumented configuration setting that, if modified, allows an attacker to redirect dictation traffic to a malicious, attacker-controlled endpoint.
This rule detects suspicious activity involving macOS LaunchAgents and files within the 'Application Support/System' directory, often associated with persistence or malicious background execution. The detection looks for the creation or modification of specific plist files (e.g., com.apple.finder.agent.plist) or git-related files in Application Support, correlated with process execution of commands like 'sysnotif-repair', 'launchctl' manipulating agents, or git operations involving custom hooks paths.
This rule detects suspicious activity involving macOS LaunchAgents and files within the 'Application Support/System' directory, often associated with persistence or malicious background execution. The detection looks for the creation or modification of specific plist files (e.g., com.apple.finder.agent.plist) or git-related files in Application Support, correlated with process execution of commands like 'sysnotif-repair', 'launchctl' manipulating agents, or git operations involving custom hooks paths.
This rule detects suspicious activity involving macOS LaunchAgents and files within the 'Application Support/System' directory, often associated with persistence or malicious background execution. The detection looks for the creation or modification of specific plist files (e.g., com.apple.finder.agent.plist) or git-related files in Application Support, correlated with process execution of commands like 'sysnotif-repair', 'launchctl' manipulating agents, or git operations involving custom hooks paths.
This rule detects suspicious activity involving macOS LaunchAgents and files within the 'Application Support/System' directory, often associated with persistence or malicious background execution. The detection looks for the creation or modification of specific plist files (e.g., com.apple.finder.agent.plist) or git-related files in Application Support, correlated with process execution of commands like 'sysnotif-repair', 'launchctl' manipulating agents, or git operations involving custom hooks paths.
Detects unauthorized modifications to the 'endo_voyager_dictation_endpoint' preference key within the 'com.meta.muse.plist' file on macOS. This key is an undocumented configuration setting that, if modified, allows an attacker to redirect dictation traffic to a malicious, attacker-controlled endpoint.
Detects unauthorized modifications to the 'endo_voyager_dictation_endpoint' preference key within the 'com.meta.muse.plist' file on macOS. This key is an undocumented configuration setting that, if modified, allows an attacker to redirect dictation traffic to a malicious, attacker-controlled endpoint.
Detects unauthorized modifications to the 'endo_voyager_dictation_endpoint' preference key within the 'com.meta.muse.plist' file on macOS. This key is an undocumented configuration setting that, if modified, allows an attacker to redirect dictation traffic to a malicious, attacker-controlled endpoint.
Detects unauthorized modifications to the 'endo_voyager_dictation_endpoint' preference key within the 'com.meta.muse.plist' file on macOS. This key is an undocumented configuration setting that, if modified, allows an attacker to redirect dictation traffic to a malicious, attacker-controlled endpoint.
Detects the creation, modification, or renaming of plist files within macOS LaunchAgent directories that match a specific naming pattern (com.[16 letters].plist). This pattern is often used by malware or unauthorized scripts to establish persistence. The rule excludes common, legitimate system processes like Installer and softwareupdated.
Detects the creation or modification of a property list (.plist) file within the /Library/LaunchAgents/ directory on macOS. The rule filters for configurations set to execute at system load, and identifies instances where the program path executed by the launch agent does not reside in standard, trusted system directories. This behavior is indicative of potential persistence mechanisms utilized by malware or unauthorized background processes.
This rule detects potential persistence attempts on macOS by monitoring 'launchctl' commands used to bootstrap LaunchAgents or modify configuration files related to Apple's software update mechanisms. It also flags file events involving the 'com.apple.softwareupdate' cache directory, which could indicate an adversary attempting to stage or replace update-related files.
Detects modification of macOS plist files to hide processes or enable autostart
This rule detects attempts to modify macOS Plist files over an SSH connection. Specifically, it looks for TCP traffic on port 22 (SSH) where the payload contains both '/Library/Preferences/' and '.plist' (case-insensitive). This activity is flagged as potential defense evasion, as modifying Plist files can be used to alter system behavior or application settings to evade security mechanisms.
Detects modification of macOS plist files to hide processes or enable autostart
This rule detects attempts to modify the Info.plist file on macOS systems to include 'LSUIElement' with a value of '<true/>'. This modification can be used by malware or unwanted applications to hide their presence from the macOS Dock and menu bar, effectively bypassing user detection and making the application run as a background process. The rule specifically looks for these two content strings within HTTP file data flowing to the client.
Detects the creation or modification of .plist files on macOS systems. This activity can be indicative of various malicious behaviors, particularly those related to persistence or privilege escalation, as .plist files are often used to configure application settings, launch agents, or other system behaviors.
The following analytic detects the usage of the `plutil` command to modify plist files on macOS systems. It leverages osquery to monitor process events, specifically looking for executions of `/usr/bin/plutil`. This activity is significant because adversaries can use `plutil` to alter plist files, potentially adding malicious binaries or command-line arguments that execute upon user logon or system startup. If confirmed malicious, this could allow attackers to achieve persistence, execute arbitrary code, or escalate privileges, posing a significant threat to the system's security.
