Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
539 detections
Filters
Last updated
All Time
Detection languages
206
149
53
41
41
Contributors
89
81
81
78
72
Categories
356
200
84
80
73
Platforms
512
43
28
5
5
Products / Services
10,665
9,773
6,705
4,421
3,749
539
MITRE Techniques
212
143
106
104
57
CVEs
5
1
1
1
1
Detects execution of the macOS.Gaslight Rust-based implant. The rule identifies the specific malicious binary by its SHA-256 hash and targets its behavior of using runtime dynamic symbol resolution (via dlsym) to hide API calls from static analysis.
Detects the macOS.Gaslight Rust-based implant receiving and executing backdoor commands (e.g., shell, kill, upload, persistence) via the Telegram Bot API. The rule correlates outbound network connections to api.telegram.org with subsequent process execution patterns typical of command dispatch (such as execvp or posix_spawnp).
Detects unauthorized processes accessing browser credential databases (e.g., Login Data, Cookies, Web Data) associated with Chromium-based browsers on macOS. This behavior is indicative of credential harvesting often performed by infostealers like AMOS (Atomic macOS Stealer).
Detects potential malware execution chains characteristic of AMOS (Atomic macOS Stealer) and related 'ClickFix' campaigns. The rule monitors for the silent downloading of a disk image (.dmg) file to the /tmp directory using curl with quiet flags, followed immediately by the mounting of that image using hdiutil with the -nobrowse flag to bypass user notification and Gatekeeper security prompts.
Detects suspicious bash one-liners executed within macOS Terminal typically associated with the AMOS (Atomic macOS Stealer) 'ClickFix' campaign. The rule monitors for a sequence involving temporary file creation, downloading a disk image (DMG) from a known malicious domain ('svs-verificationdate.beer'), and silently attaching the DMG via hdiutil.
Detects the creation of a LaunchAgent property list (.plist) file on macOS that uses a spoofed Apple namespace label (com.apple.system.services.activity). This behavior is characteristic of the Gaslight malware family attempting to establish persistence.
Detects suspicious attempts to access macOS Keychain or browser credentials (Chrome, Firefox) using 'osascript' or 'security' command-line utilities. This rule identifies patterns indicative of credential dumping or access, such as unlocking keychains, finding generic passwords, or accessing browser-specific credential files.
Detects various suspicious activities related to macOS wallet applications, including the removal of Gatekeeper quarantine flags, ad-hoc re-signing of application bundles, force-killing wallet applications, non-installer processes writing to application bundles (specifically 'app.asar'), and the use of 'dscl . authonly' which can be abused for fake password prompts.
Rust-based macOS infostealer implant embedding prompt injection payloads
Rust-based macOS infostealer implant embedding prompt injection payloads
macOS malware used by JINX-0164 against cryptocurrency developers
This rule detects suspicious attempts to access macOS Keychain credentials using the 'security' command-line utility or 'osascript'. It specifically looks for 'security' commands attempting to find generic or internet passwords, unlock keychains, or target browser-specific safe storage keys (Chrome, Brave, Microsoft Edge). It also flags 'osascript' processes accessing Keychain paths. The rule excludes legitimate system and browser processes to reduce false positives.
Detects unauthorized processes attempting to read sensitive application data directories (specifically for Telegram and Discord) on macOS. This behavior is indicative of infostealer malware, such as AMOS (Atomic macOS Stealer), attempting to exfiltrate session tokens and account information.
Detects the Meow RAT malware attempting to identify the system locale and keyboard settings on macOS. This behavior is used by the malware to fingerprint the target environment and specifically avoid infection if the system is identified as belonging to CIS (Commonwealth of Independent States) regions.
Detects the use of osascript to spawn fake macOS system dialogs that mimic legitimate 'System Preferences' prompts to harvest user login passwords. This activity often involves AppleScript dialog commands combined with dscl authonly checks to validate the stolen credentials.
This rule detects macOS 'sharingd' or 'Foundation' service crashes (stack overflow, recursion limit exceeded, or EXC_BAD_ACCESS) that occur during the processing of plist files. This behavior is indicative of potential memory corruption exploits targeting vulnerabilities in Apple's plist parsing logic, potentially exploited via AirDrop.
This rule detects potential memory corruption or malformed HTTP frame handling issues in macOS services related to AirDrop (AirDrop, sharingd, nsurlsessiond). It specifically monitors unified logs for error messages indicating null pointer dereferences, invalid chunk sizes, or malformed content-length headers within the network.framework stack.
Detects potential fileless execution of Meow RAT by monitoring process command lines for 'curl' fetching an AppleScript payload and piping it to 'osascript'. It also looks for specific Meow RAT indicators like C2 domains, payload names, and build hashes.
Detects instances where the Amazon Q Developer extension spawns suspicious child processes, such as bash or npx, which may indicate the execution of arbitrary commands defined in a potentially malicious .amazonq/mcp.json workspace configuration file.
Detects a single process reading both SSH private keys and various developer-sensitive configuration or credential files (e.g., .aws/credentials, .npmrc, .pypirc) on a single host. This behavior is consistent with infostealer activity, such as the Miasma JavaScript infostealer used in supply chain campaigns, aiming to harvest credentials from developer workstations.
Detects the presence or installation of known malicious Adblock for YouTube browser extensions. These extensions are flagged for utilizing overly broad host permissions (e.g., <all_urls>) in conjunction with webRequest and scripting capabilities, which facilitates cross-site data collection, potential session hijacking, and the injection of malicious remote scripts.
Page 16 of 26