Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,640 detections
Filters
Last updated
All Time
Detection languages
1,764
375
349
273
255
Contributors
908
661
593
359
164
Categories
1,498
1,162
780
529
520
Platforms
39,950
7,275
6,526
3,865
3,640
Products / Services
812
512
432
342
298
MITRE Techniques
1,184
574
524
506
443
CVEs
17
16
9
8
8
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects the execution of programs as Launch Agents or Launch Daemons using the `launchctl` command on macOS. This activity can be indicative of persistence mechanisms established by adversaries.
This rule detects macOS malware associated with the North Korean threat actor group CitrineSleet (also known as AppleJeus or UNK_JuiceHead). It specifically identifies binaries that exhibit consistent Dylib and Entitlement usage patterns observed in variants like UpdateAgent, SimpleTea (aka POOLRAT), and CrashReporter. The detection is based on matching specific hashes for the dylib and entitlement sections within Mach-O executable files.
This rule detects the Amos Stealer malware by identifying specific dylib and entitlement hashes within Mach-O files. It targets macOS executables that exhibit these unique characteristics associated with the Amos Stealer.
This rule detects attempts to capture user credentials on macOS by leveraging the `osascript` utility to display system dialog prompts. It specifically looks for `osascript` executions that include commands to 'display dialog' with keywords commonly associated with credential requests, such as 'admin', 'password', 'authenticate', or 'credentials'. This technique can be used by adversaries to present seemingly legitimate pop-ups to trick users into entering their credentials.
Detects the Node Package Manager (npm) or npx spawning child processes commonly used to download remote files. This behavior is often seen in malicious npm packages that use post-install scripts to fetch and execute second-stage payloads, as seen with the AdaptixC2 framework delivery.
Detects known malicious file hashes associated with malware families (VIDAR, LUMMAC.V2, RADTHIEF, ATOMIC) distributed by the threat actor UNC5142.
The analytic detects the use of the curl command contacting suspicious remote domains, such as s3.amazonaws.com, which is indicative of Command and Control (C2) activity or downloading further implants. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs and command-line arguments. This activity is significant as it may indicate the presence of MacOS adware or other malicious software attempting to establish persistence or exfiltrate data. If confirmed malicious, this could allow attackers to maintain control over the compromised system and deploy additional payloads.
Detects the execution of the 'xattr -c' command on a macOS endpoint. This command is used to clear all extended attributes from a file, including the 'com.apple.quarantine' attribute set by Gatekeeper on downloaded files. UNC5142 uses this technique to bypass macOS security prompts before executing downloaded malware like the ATOMIC infostealer.
Detects when a Visual Studio Code configuration file is modified, followed by the execution of a shell or networking tool by VS Code. This pattern may indicate abuse of GitHub Copilot via prompt injection (CVE-2025-53773) to achieve remote code execution.
This correlation rule identifies multiple risk events associated with the "Living Off The Land" analytic story. It aggregates and correlates events tagged under this story, focusing on systems with a high count of distinct sources (5 or more). The rule aims to detect suspicious behavior involving the use of legitimate tools for malicious purposes, which could lead to code execution, privilege escalation, or persistence within an environment.
The following analytic detects multiple executions of Living off the Land (LOLbin) binaries on macOS within a short period. It leverages osquery to monitor process events and identifies commands such as "find", "crontab", "screencapture", "openssl", "curl", "wget", "killall", and "funzip". This activity is significant as LOLbins are often used by attackers to perform malicious actions while evading detection. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, or persist within the environment, posing a significant security risk.
The analytic detects AMOS Stealer VM check activity on macOS. It identifies the execution of the "osascript" command along with specific commandline strings that include "set", "system_profiler", and either "VMware" or "QEMU". This activity is indicative of AMOS stealer attempting to determine if it is running within a virtual machine environment. If confirmed malicious, this behavior suggests the host is infected by the AMOS stealer, which could lead to arbitrary code execution, privilege escalation, information theft, or persistence, posing a significant security risk.
The following analytic detects processes on macOS systems that are tapping keyboard events, potentially monitoring all keystrokes made by a user. It leverages data from osquery results within the Alerts data model, focusing on specific process names and command lines. This activity is significant as it is a common technique used by Remote Access Trojans (RATs) to log keystrokes, posing a serious security risk. If confirmed malicious, this could lead to unauthorized access to sensitive information, including passwords and personal data, compromising the integrity and confidentiality of the system.
Detects HTML phishing pages created by the 'IUAM ClickFix Generator'. These pages mimic browser verification challenges to trick users into executing malicious PowerShell or Bash commands to deliver infostealers like DeerStealer and Odyssey.
Tracks network events involving connections to specific Visual Studio Tunnel API URLs, which are used for remote development scenarios (like Visual Studio Code's Live Share or remote tunneling features).
This rule detects attempts to browse or access a predefined list of potentially malicious software packages. It monitors proxy logs for occurrences of these package names within the 'file.name' field. Further investigation of network traffic volume (bytes in/out) is recommended to ascertain if a download of the malicious package has taken place.
This rule detects the use of 'launchctl load -w' commands on macOS systems, which is a common method for establishing persistence by loading Launch Agents or Daemons. It specifically looks for process creation events where 'launchctl' is involved with the 'load -w' parameters, while excluding known legitimate processes from Palo Alto Networks, Apple, Zscaler, Adobe, Citrix, Microsoft, Netskope, Red Giant, and Logitech to reduce false positives.
Detects the execution of NetCat (nc) on macOS systems. NetCat is a versatile networking utility that can be used for various purposes, including port scanning, banner grabbing, file transfers, and creating backdoors. This rule specifically looks for process creation events where the process name is 'nc' and excludes known legitimate uses by 'Jamf Connect' and 'TruU Authenticator', as well as a specific health check script.
Detects the execution of programs as Launch Agents or Launch Daemons using launchctl on macOS.
Detects potential persistence activity using LaunchAgents or LaunchDaemons via the PlistBuddy utility
Detects the command line executed when TeamViewer starts a session started by a remote host.
Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.
Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.
Page 163 of 174