Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
539 detections
Filters
Last updated
All Time
Detection languages
206
149
53
41
41
Contributors
89
81
81
78
72
Categories
356
200
84
80
73
Platforms
512
43
28
5
5
Products / Services
10,665
9,773
6,705
4,421
3,749
539
MITRE Techniques
212
143
106
104
57
CVEs
5
1
1
1
1
Detects the creation or modification of a specific macOS plist file ('com.apple.crashreporter.helper.plist') within the '/Library/LaunchAgents/' directory, correlated with a file event occurring in '/Library/Caches/' within a one-hour window. This behavior is indicative of an adversary attempting to establish persistence by impersonating a legitimate Apple system process and utilizing cache directories to host malicious payloads.
Detects processes other than the authorized system processes ('security' and 'securityd') interacting with the login.keychain-db file. Adversaries often target this file to extract stored credentials from the macOS keychain.
Detects the execution of the xattr command with the '-cr' flags on macOS. This combination is commonly used to recursively remove the com.apple.quarantine extended attribute from files and directories, which effectively bypasses macOS Gatekeeper security checks for downloaded applications or files.
Detects repeated execution of 'defaults read' or 'du -sh' commands within a one-hour window. These commands are commonly used for system information and file directory discovery, which may indicate reconnaissance activity by an attacker.
Detects instances where a Unix shell (sh, bash, dash, ash) is spawned by or initiated from the 'ff-agent' process. This pattern often indicates malicious script execution or administrative activity associated with the agent's environment, potentially signaling post-exploitation activity or unauthorized command execution.
Detects new file creation or modification events within the /Library/Caches/ directory of user profiles on macOS. Adversaries may utilize these directories for persistence, staging, or hiding malicious payloads.
Detects process execution where the process path or the initiating process path resides within the '/private/tmp/.CrashReporter' directory. This directory is often used by adversaries to hide malicious binaries or scripts in a location that might appear legitimate but is generally inappropriate for persistence or staging.
Detects the use of the security command-line tool with the 'unlock-keychain' argument and the '-p' flag, which indicates an attempt to programmatically unlock a keychain, potentially using a supplied password.
This rule detects unauthorized read, creation, modification, or renaming activity involving sensitive browser files (Login Data, Cookies, Web Data) on macOS. Adversaries often target these files to extract saved credentials, cookies for session hijacking, or browsing history.
Detects the creation, modification, or renaming of ZIP archive files prefixed with 'zx_' within the macOS crash reporter cache directory. This behavior may indicate an adversary staging crash report data for potential exfiltration.
Detects execution of common shell interpreters initiated by or containing references to ff-agent.
Detects unauthorized attempts to modify or interact with the macOS Transparency, Consent, and Control (TCC) database. This includes direct file system modifications by non-system processes, sqlite-based manipulation of the TCC database, or the usage of 'tccutil' to reset permissions. These behaviors are often indicative of malware attempting to silently elevate privileges or grant itself Full Disk Access to sensitive user data.
Detects the execution of processes originating from the /private/tmp/.CrashReporter directory on macOS systems. This path is often used by adversaries to store or execute malicious binaries in a hidden, temporary location to evade detection.
Detects the execution of a process named 'Werkbit' or containing 'Werkbit' in its command line that is associated with 'com.apple.crashreporter' but is located outside the standard '/Applications/' directory on macOS. This behavior may indicate an attempt to masquerade or execute unauthorized code disguised as a crash reporting process.
Detects the use of the macOS 'codesign' utility with command-line flags that suggest an attempt to sign a binary with an empty or improperly formatted identity string. This pattern is often used to quickly sign binaries with an ad-hoc signature to bypass security restrictions or for malicious purposes.
Detects the use of 'osascript' to execute AppleScript-based dialog boxes designed to trick users into providing credentials or mimicking system administration prompts. These scripts use labels often associated with fake security or permission requests to harvest passwords.
Detects the execution of macOS command interpreters (osascript, sh, bash, zsh) where the command line arguments reference specific timezones (e.g., Moscow, Minsk) or locale settings (e.g., RU, BY, KZ, AM, AZ). This pattern is often associated with adversary attempts to detect or evade sandbox environments based on regional settings or to align with specific target geographic profiles.
Detects the creation of a .plist file in a user LaunchAgents directory within 300 seconds of the process loading the ServiceManagement framework. This pattern is often used by macOS applications to establish persistence or perform background tasks, but can be indicative of malicious activity if associated with unauthorized or masquerading binaries.
Detects processes attempting to interact with the macOS NSPasteboard (clipboard) that are not typically associated with standard clipboard utility operations like Maccy, pbcopy, or pbpaste. This may indicate unauthorized data collection or exfiltration of sensitive information copied to the system clipboard.
Detects enumeration of local system accounts on MacOS systems.
This can be used by attackers to identify accounts for lateral movement or privilege escalation.
This can be used by attackers to identify accounts for lateral movement or privilege escalation.
Detects the execution of an AppleScript file via the osascript utility that initiates a network connection within a 5-minute window of execution. This behavior is often indicative of automated script-based network activity, such as command-and-control communication or data exfiltration.
Page 12 of 26