Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
539 detections
Filters
Last updated
All Time
Detection languages
206
149
53
41
41
Contributors
89
81
81
78
72
Categories
356
200
84
80
73
Platforms
512
43
28
5
5
Products / Services
10,665
9,773
6,705
4,421
3,749
539
MITRE Techniques
212
143
106
104
57
CVEs
5
1
1
1
1
Detects unauthorized mass access to AI development tool configuration files and credentials. The rule identifies processes reading sensitive files associated with tools such as Claude (mcp.json, projects), Codex (config.toml, sessions), Gemini (settings.json, .env), Cline, OpenCode, and Kilo.
Detects the download of a standalone CPython 3.10.18 interpreter from github.com/astral-sh/python-build-standalone using curl, followed by the extraction of the compressed archive using tar. This behavior is associated with the macOS.Gaslight malware's secondary collection module installer, which likely prepares a localized Python environment to execute further malicious tasks.
Detects the AMOS infostealer staging collected system data by using the macOS ditto utility to compress information into a hidden .hipr directory. The rule identifies the execution of ditto with .hipr in the command line in conjunction with the creation of User_Name.txt and System_Information.txt within that same directory.
Detects the AMOS infostealer attempting to access and enumerate browser extension directories on macOS to harvest cryptocurrency wallet data from Chrome and Firefox profiles.
Detects potential information stealing activity, specifically the Atomic macOS Stealer (AMOS) malware, by monitoring unauthorized processes accessing Safari cookies and Apple Notes databases, excluding legitimate applications.
Detects potential activity associated with the AMOS infostealer, where common terminal commands (cp or mv) are used to manipulate or replace legitimate Ledger Live or Trezor Suite cryptocurrency wallet applications located in the /Applications directory on macOS.
Detects the use of 'hdiutil' to mount disk images with the '-nobrowse' flag, initiated by common command-line or scripting interpreters. The '-nobrowse' flag prevents the mounted volume from appearing on the desktop or in Finder, which is a common technique used by attackers to mount malicious disk images stealthily to facilitate execution of payloads while avoiding user detection.
Detects network connection activity on common C2 ports from processes executing outside of standard system directories. The rule filters out known system paths on macOS and identifies processes that establish multiple connections to non-private IP addresses, assigning a risk score based on the volume of connections and the duration of the activity to identify potential command and control (C2) beaconing behavior.
Detects suspicious process activity involving common macOS command-line tools (osascript, sh, bash, zsh, cp) attempting to access sensitive browser data (Chrome, Edge login data, cookies, web data) or macOS keychain files. This rule specifically excludes activity initiated by the browsers themselves to reduce false positives.
This rule detects a multi-stage attack chain on macOS involving a browser or mail client spawning a shell to download a file (DMG) via curl/wget, followed by the mounting of that disk image, execution of an application bundle from the mounted volume, and a subsequent outbound network connection from that application. This behavior is indicative of a user-initiated malware execution chain.
Detects behaviors associated with AMOS and Odyssey Stealer, including using osascript to perform anti-analysis checks via system_profiler and terminating OneDrive services to impair defenses.
Detects when development tools such as VS Code, VS Code OSS, or Node.js spawn a shell (bash/sh) to execute network-related commands (aws, curl, wget, npx). This behavior is characteristic of an adversary leveraging a developer's environment to download payloads, interact with cloud resources, or perform reconnaissance.
Detects behavior attributed to the AMOS (Atomic macOS Stealer) malware, where a shell process uses 'setsid' to detach from the current terminal session, followed immediately by the execution of 'killall Terminal' to conceal the execution of malicious commands.
Detects the execution of a Python-based collection module associated with the Gaslight malware on macOS. The module performs reconnaissance by enumerating system information using 'system_profiler' and running processes via 'ps aux', followed by the collection of sensitive data including browser files and the login keychain.
Detects the creation of a LaunchAgent property list file in the user's Library directory that masquerades as an Apple-related process (com.apple.*). This behavior is associated with the macOS.Gaslight malware family, which uses such files for persistence, often with specific arguments like --type=renderer.
Detects the execution of osascript spawned directly from the Terminal application, a pattern identified in Meow RAT campaigns using ClickFix social engineering lures to execute malicious AppleScript in-memory.
This rule detects the execution of multiple common macOS utilities ('ps', 'system_profiler', 'sw_vers', 'sysctl', 'uname') with specific command-line arguments often used for system information discovery. The rule identifies instances where these commands are executed by a single initiating process, excluding common shell processes, and flags executions originating from suspicious temporary or library paths.
Detects macOS Python processes creating zip archives in temporary or 'collected_data' folders, potentially indicating data collection and exfiltration staging. The rule specifically looks for Python processes that have previously accessed sensitive paths like 'login.keychain-db' or performed data collection/compression activities.
This rule detects suspicious activities related to cryptocurrency wallet applications, potentially indicating a 'Meow RAT' infection or similar compromise. It looks for modifications to crypto wallet application files (specifically 'app.asar'), attempts to terminate crypto wallet processes using 'pkill', and suspicious 'codesign' commands targeting wallet applications. The rule also identifies command-line patterns associated with known trojanized wallet versions.
This rule detects attempts to enumerate keyboard input sources or search for Russian keyboard layouts on macOS systems. This activity can be indicative of an adversary performing a 'geofence' check to determine the system's locale or origin, potentially to avoid targeting specific regions.
This rule detects suspicious script execution on macOS devices that targets known cryptocurrency wallet applications or data files. It looks for command-line executions involving common shell interpreters (sh, bash, zsh, osascript) that contain strings associated with Ledger Live, Trezor Suite, Exodus, Electrum, or generic 'wallet.dat' files. This activity could indicate an attempt to steal cryptocurrency wallet information or funds.
Page 17 of 26