Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
539 detections
Filters
Last updated
All Time
Detection languages
206
149
53
41
41
Contributors
89
81
81
78
72
Categories
356
200
84
80
73
Platforms
512
43
28
5
5
Products / Services
10,665
9,773
6,705
4,421
3,749
539
MITRE Techniques
212
143
106
104
57
CVEs
5
1
1
1
1
Detects PamStealer's embedded helper binary dropped to /private/tmp/System Settings and used to establish legacy login item persistence via osascript System Events
Detects the Finder application on macOS loading authentication modules (libpam.dylib) from within the 'Application Support' directory. The rule further correlates this by checking if common system utility tools (dscl, security, osascript) were initiated by the same Finder process path, flagging cases where legitimate system activity is absent, which may indicate potential dylib hijacking or suspicious process behavior.
Detects a sequence of actions on macOS where an attacker removes the quarantine extended attribute (com.apple.quarantine) using 'xattr' and subsequently performs ad-hoc code signing using 'codesign' on the same system. This behavior is indicative of an attempt to bypass macOS Gatekeeper security controls to execute untrusted or malicious binaries.
Detects the use of the 'security' command-line utility to interact with the 'login.keychain-db' file on macOS, which is a common technique used by adversaries to dump credentials.
Detects the creation or modification of a file named '.config' within the path 'Library/Application Support/com.apple.finder.core/'. This behavior is indicative of potential persistence mechanisms, as adversaries often use hidden files within application support directories to maintain foothold or store configurations on macOS.
Detects the PamStealer second-stage Rust-based arm64 Mach-O infostealer masquerading as Finder, identified by known SHA256 hash and embedded Rust toolchain build artifacts
Detects the second-stage Rust-based Mach-O binary downloaded and executed by the PamStealer JXA stager, identified via embedded C2 domain strings
This rule detects the creation of specific hidden files ('.Maccy', '.lock', '.config') within the 'Library/Application Support/com.apple.finder.core/' directory on macOS. This behavior is indicative of potential persistence mechanisms, configuration tampering, or malicious activity related to the Finder application environment.
Detects instances where a process located outside of the standard '/System/' or '/usr/' directories loads the 'Security.framework' library. This behavior is suspicious as it may indicate an attempt by an untrusted or malicious binary to hook into or interact with system-level security services, such as keychain or cryptographic APIs.
Detects the creation, modification, or renaming of a specific property list file ('com.apple.system.services.activity') within the macOS LaunchAgents directory, a common technique used by attackers to maintain persistence on compromised systems.
Detects the 'codesign' utility being invoked with flags '-fs' (force sign) and '--deep' (recursively sign) triggered by a shell process spawned from 'Script Editor'. This pattern is often used to bypass macOS Gatekeeper or attempt to re-sign malicious applications after tampering.
Detects the execution of AppleScript files named 'Maccy.scpt' using the 'osascript' or 'Script Editor' utilities. The rule correlates this process execution with network activity directed towards the 'maccyapp.com' domain within a one-hour window, identifying potential unauthorized or malicious scripting behavior involving Maccy-related artifacts.
Detects the use of 'codesign' by 'Script Editor' on macOS to sign files within the '/Library/Application Support/' directory. This behavior is indicative of potential malicious activity, such as attempting to bypass Gatekeeper or signing tampered application files to maintain persistence or evade security controls.
Detects execution of processes named 'Finder' or 'Software Update' that originate from within the '/Library/Application Support/' directory on macOS. This pattern is indicative of potential masquerading where malicious binaries or persistent payloads are placed in shared application support folders to mimic legitimate system components.
Detects the macOS 'Finder' process loading 'ServiceManagement.framework' from a non-standard path within '/Library/Application Support/'. This behavior is highly suspicious as Finder should typically load system frameworks from standard paths, and unexpected module loading in this context may indicate code injection, tampering, or malicious activity disguised as part of the operating system.
Detects the execution of processes that display a fake password prompt masquerading as system utilities like Maccy or Finder. This behavior is indicative of credential phishing or a social engineering attempt to steal user credentials by prompting for a password under the guise of a system update or configuration change.
This rule detects command-line execution or activity containing specific strings associated with a fake 'damaged application' dialog box on macOS. This behavior is indicative of the PamStealer malware or similar social engineering campaigns that attempt to deceive users into believing their application is corrupt, thereby tricking them into interacting with malicious artifacts.
Detects unusual network connections or process creation events originating from the 'sharingd' daemon on macOS. 'sharingd' handles various Apple sharing features (AirDrop, Handoff, Shared Clipboard). Unusual child processes or network activity involving this daemon may indicate abuse for unauthorized data transfer, lateral movement, or remote service interaction.
Detects suspicious execution of Python or shell scripts (bash, zsh, sh) from paths associated with 'openclaw' or 'clawhub' that are interacting with sensitive data files, including browser credential stores (Chrome, Firefox, Edge, Brave), system keychains, and cryptocurrency wallet files.
Detects abnormal termination, crash, or error messages related to the 'sharingd' process on macOS. 'sharingd' is a daemon responsible for various sharing features including AirDrop, Handoff, and Instant Hotspot. Unexpected errors or crashes within this process may indicate service instability, potential exploitation attempts, or abnormal interactions with sharing services.
Detects the creation of power management assertions using the IOPMAssertionCreateWithName API by processes other than standard system binaries. Attackers may use this technique to prevent a system from sleeping, which can be leveraged to maintain persistence or ensure that malicious background activities continue without interruption.
Page 13 of 26