Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
539 detections
Filters
Last updated
All Time
Detection languages
206
149
53
41
41
Contributors
89
81
81
78
72
Categories
356
200
84
80
73
Platforms
512
43
28
5
5
Products / Services
10,665
9,773
6,705
4,421
3,749
539
MITRE Techniques
212
143
106
104
57
CVEs
5
1
1
1
1
This rule detects a multi-stage attack chain on macOS involving a browser or mail client spawning a shell to download a file (DMG) via curl/wget, followed by the mounting of that disk image, execution of an application bundle from the mounted volume, and a subsequent outbound network connection from that application. This behavior is indicative of a user-initiated malware execution chain.
This rule detects a sequence of suspicious activities on macOS: downloading a file from a potentially malicious source using curl, mounting a disk image using hdiutil, and subsequently opening files from the mounted volume. This pattern is commonly associated with the delivery and execution of malicious payloads, such as trojanized software or malware installers.
Detects the creation of plist files within macOS /Library/LaunchAgents/ or /Library/LaunchDaemons/ directories by the osascript utility. This behavior is indicative of Meow RAT establishing persistence by masquerading as a legitimate system service.
Detects anomalous child process execution (e.g., bash, sh, npx, node) spawned directly by AI coding assistants or IDE extensions (Claude Code, Cursor, Amazon Q). This behavior, specifically involving auto-executed configurations like mcp.json, is indicative of exploitation attempts targeting AI coding environments where remote code execution (RCE) can be achieved via untrusted configurations or injected prompts.
macOS malware used by JINX-0164 against cryptocurrency developers
Detects the creation or modification of specific malicious macOS LaunchAgent plist files (com.nvm.protocal.plist) or payload files (protocal.cjs) within the NodePackages directory, indicative of the easy-day-js backdoor establishing persistence.
Detects unusual network connections or process creation events originating from the 'sharingd' daemon on macOS. 'sharingd' handles various Apple sharing features (AirDrop, Handoff, Shared Clipboard). Unusual child processes or network activity involving this daemon may indicate abuse for unauthorized data transfer, lateral movement, or remote service interaction.
Detects suspicious execution of Python or shell scripts (bash, zsh, sh) from paths associated with 'openclaw' or 'clawhub' that are interacting with sensitive data files, including browser credential stores (Chrome, Firefox, Edge, Brave), system keychains, and cryptocurrency wallet files.
Detects execution of the macOS 'security' utility to harvest generic or internet passwords from the Keychain, a technique commonly associated with the AMOS (Atomic macOS Stealer) infostealer for credential theft.
Detects the AMOS (Atomic macOS Stealer) infection chain where a shell (e.g., Terminal, bash) executes curl to download a DMG file to a temporary directory, followed immediately by the use of hdiutil with the -nobrowse flag to mount the disk image silently, effectively bypassing macOS Gatekeeper UI prompts to the user.
This rule detects potentially malicious child processes spawned by Amazon Q or AWS Language Server components (e.g., amazon-q, aws-lsp-server). The rule specifically flags behavior associated with the loading of MCP server configurations, potential unauthorized access to AWS credentials, or network data exfiltration attempts through commonly abused binaries like shell interpreters, python, or curl/wget when these are not signed by Amazon.
Detects macOS Terminal (bash/zsh) retrieving loader.sh or payload.applescript directly from the ClickFix attacker infrastructure.
Detects the creation or modification of suspicious Launch Agent or Launch Daemon .plist files, or a hidden application support directory, masquerading as 'com.apple.accountsd' on macOS. This behavior is often indicative of persistence mechanisms used by adversaries.
Detects behavior indicative of the AMOS (Atomic macOS) infostealer, where a malicious process uses 'osascript' to display a fake System Preferences password prompt to the user and then attempts to validate the harvested credentials using 'dscl -authonly'.
Detects execution of macOS.Gaslight malware by identifying specific function calls within process command lines, specifically 'SecTrustSetAnchorCertificatesOnly' for certificate pinning, 'SCDynamicStoreCopyProxies' for proxy awareness, and 'CCRandomGenerateBytes' for cryptographical operations. These behaviors are typical of the implant's efforts to maintain encrypted C2 communication while frustrating network inspection tools.
Detects unauthorized access to Chrome and Firefox browser credential (Login Data, logins.json, key4.db) and cookie database files on macOS by non-browser processes, commonly observed in credential theft campaigns like ClickFix.
Detects the execution of hidden shell scripts (.sh or .command) located within a mounted disk image (.dmg). This pattern is commonly used by macOS infostealers which masquerade as legitimate applications (such as Notion, Arc, or Raycast) to trick users into executing malicious code after mounting the deceptive installer.
Detects the use of 'hdiutil' to mount disk images with the '-nobrowse' flag, initiated by common command-line or scripting interpreters. The '-nobrowse' flag prevents the mounted volume from appearing on the desktop or in Finder, which is a common technique used by attackers to mount malicious disk images stealthily to facilitate execution of payloads while avoiding user detection.
This rule monitors process command lines and file activity for keywords associated with potential reconnaissance, error logs, or debugging artifacts often used during post-exploitation or system profiling. It flags commands or files containing terms like 'memory dump', 'stack trace', 'SQL injection', or 'Redis failure', which may indicate an attacker analyzing system information or attempting to interact with backend services.
Detects potential command injection attacks against AI agents through
suspicious prompt patterns or system command execution by AI processes.
suspicious prompt patterns or system command execution by AI processes.
Detects anomalous system and process enumeration activity characteristic of the macOS.Gaslight threat, specifically looking for repeated execution of diagnostic commands like ps, sysctl, uname, and sw_vers in a short timeframe, which suggests an attempt to profile the infected host environment.
Page 15 of 26