Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
539 detections
Filters
Last updated
All Time
Detection languages
206
149
53
41
41
Contributors
89
81
81
78
72
Categories
356
200
84
80
73
Platforms
512
43
28
5
5
Products / Services
10,665
9,773
6,705
4,421
3,749
539
MITRE Techniques
212
143
106
104
57
CVEs
5
1
1
1
1
Detects network connection activity on common C2 ports from processes executing outside of standard system directories. The rule filters out known system paths on macOS and identifies processes that establish multiple connections to non-private IP addresses, assigning a risk score based on the volume of connections and the duration of the activity to identify potential command and control (C2) beaconing behavior.
This rule detects shell commands (bash, sh, zsh) initiated by AI-agent or development-related processes (e.g., Python, Claude Desktop, openclaw) that target sensitive macOS paths associated with credentials, SSH keys, crypto wallets, and browser cookies, a technique characteristic of the Atomic Stealer (AMOS) malware.
This rule detects a sequence of suspicious activities on macOS: downloading a file from a potentially malicious source using curl, mounting a disk image using hdiutil, and subsequently opening files from the mounted volume. This pattern is commonly associated with the delivery and execution of malicious payloads, such as trojanized software or malware installers.
This rule detects shell commands (bash, sh, zsh) initiated by AI-agent or development-related processes (e.g., Python, Claude Desktop, openclaw) that target sensitive macOS paths associated with credentials, SSH keys, crypto wallets, and browser cookies, a technique characteristic of the Atomic Stealer (AMOS) malware.
This rule detects the use of the 'SecTrustSetAnchorCertificatesOnly' macOS Security framework API call. This API is used to restrict trust to only the anchor certificates provided, which is a technique often used by malware or malicious scripts to bypass security trust controls, intercept TLS/SSL traffic, or facilitate adversary-in-the-middle attacks.
macOS malware used by JINX-0164 against cryptocurrency developers
Detects the execution of AppleScript files by the Script Editor application or the osascript utility, often associated with Maccy.scpt, which may indicate unauthorized script execution or automation attempts.
Detects a process masquerading as 'Finder' (i.e., having a different file path than the legitimate macOS Finder) that attempts to open System Settings, System Preferences, or the 'open' command to interact with Apple System Preferences related to Full Disk Access or Security settings. This behavior is indicative of an adversary attempting to modify privacy permissions or bypass system security controls.
Detects the execution of the 'csrutil status' command, which is used to check the status of System Integrity Protection (SIP) on macOS. This query specifically looks for this command being executed by 'osascript' or 'Script Editor', which are common methods used to automate or hide the command execution.
Detects instances where 'Script Editor' or processes containing 'Maccy' in their command line access specific timezone files in /usr/share/zoneinfo. This behavior is indicative of potential environment checks for virtualization or sandbox detection, as attackers may attempt to identify or spoof the system's timezone to evade security analysis.
This rule monitors process command lines and file activity for keywords associated with potential reconnaissance, error logs, or debugging artifacts often used during post-exploitation or system profiling. It flags commands or files containing terms like 'memory dump', 'stack trace', 'SQL injection', or 'Redis failure', which may indicate an attacker analyzing system information or attempting to interact with backend services.
Detects suspicious subprocesses spawned by IDE or extension host processes (like VS Code or Amazon Q) that execute AWS CLI commands to enumerate identity or immediately exfiltrate data via curl/wget, indicating potential credential abuse by malicious plugins or MCP servers.
macOS malware used by JINX-0164 against cryptocurrency developers
Detects abnormal termination, crash, or error messages related to the 'sharingd' process on macOS. 'sharingd' is a daemon responsible for various sharing features including AirDrop, Handoff, and Instant Hotspot. Unexpected errors or crashes within this process may indicate service instability, potential exploitation attempts, or abnormal interactions with sharing services.
This rule detects macOS 'sharingd' or 'Foundation' service crashes (stack overflow, recursion limit exceeded, or EXC_BAD_ACCESS) that occur during the processing of plist files. This behavior is indicative of potential memory corruption exploits targeting vulnerabilities in Apple's plist parsing logic, potentially exploited via AirDrop.
This rule detects potential memory corruption or malformed HTTP frame handling issues in macOS services related to AirDrop (AirDrop, sharingd, nsurlsessiond). It specifically monitors unified logs for error messages indicating null pointer dereferences, invalid chunk sizes, or malformed content-length headers within the network.framework stack.
This rule detects the execution of 'hdiutil' to attach a disk image with the '-nobrowse' flag, initiated by various scripting interpreters (bash, zsh, python, etc.) or terminal applications. This pattern is frequently used by adversaries to silently mount malicious payloads or tools contained within disk images while bypassing user interaction.
Detects unexpected subprocesses (bash, sh, npx) spawned by the Amazon Q language server process. This behavior is indicative of a potential exploit targeting the Model Context Protocol (MCP) auto-execution vulnerability (tracked as CVE-2026-12957), where a malicious .amazonq/mcp.json workspace configuration is used to gain unauthorized code execution.
This rule detects attempts by common scripting or utility processes (like osascript, curl, zsh, bash, sh, python) to access sensitive macOS files, specifically targeting browser data (Chrome, Brave, Firefox) and keychain files. This activity could indicate an attacker attempting to exfiltrate credentials, session tokens, or other sensitive user data.
Detects the Atomic macOS Stealer (AMOS) malware establishing persistence by creating a LaunchAgent plist file ('com.hlpr.agent.plist') and subsequently loading it using the 'launchctl' utility.
Detects unauthorized usage of the 'osascript' command to interact with the 'security' binary on macOS, specifically targeting keychain operations such as dumping, finding generic passwords, or unlocking the login keychain. This behavior is indicative of Meow RAT attempting to exfiltrate credentials from the macOS Keychain or browser-stored secrets.
Page 14 of 26