Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,640 detections
Filters
Last updated
All Time
Detection languages
1,764
375
349
273
255
Contributors
908
661
593
359
164
Categories
1,498
1,162
780
529
520
Platforms
39,950
7,275
6,526
3,865
3,640
Products / Services
812
512
432
342
298
MITRE Techniques
1,184
574
524
506
443
CVEs
17
16
9
8
8
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects the execution of suspicious child processes from macOS installer package parent processes. This includes various scripting interpreters like osascript, JXA, and common network utilities like curl and wget, which can be abused during preinstall or postinstall phases of a package installation.
Detects attempts to extract credentials from macOS Keychain using the 'security' command-line utility. This rule specifically looks for the use of 'security' with arguments like 'find-certificate', 'export', 'dump-keychain', or 'login-keychain', which are commonly used to access or dump Keychain contents.
Detects potential suspicious child processes of "jamf". This could indicate the abuse of Jamf as a C2 server, as observed with the Typhon MythicAgent. Specifically, the rule looks for '/bash' or '/sh' being spawned as child processes of the 'jamf' executable.
Detects the use of common network scanning tools like netcat, nmap, and telnet on macOS systems. The rule specifically looks for process creation events where the image path ends with '/nc', '/netcat', '/nmap', or '/telnet'. It includes a filter to exclude 'netcat' commands containing 'l' (often used for legitimate listening modes), aiming to reduce false positives related to simple network listening.
Detects the usage of tooling to sniff network traffic. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
Detects attempts to use the built-in 'screencapture' utility to collect screenshots on macOS systems. This utility can be used by adversaries to gather visual information from a compromised system.
Detects enumeration of local system groups on macOS using common command-line utilities such as `dscacheutil`, `cat`, and `dscl`. This activity is often performed by adversaries during the discovery phase to identify privileged accounts or groups for lateral movement or privilege escalation.
Detects when the built-in 'openssl' utility is used on macOS to decode and decrypt a payload, specifically when the command line arguments indicate base64 encoding and decryption, and the input file is located within a '/Volumes/' path. This behavior is often observed in adware or malware families like Bundlore and Shlayer, which use disk images (DMGs) to deliver encoded and encrypted payloads to evade detection and trick users into execution.
Detects the creation of scheduled tasks using the 'crontab' utility on macOS, specifically when the command line indicates the crontab job is being uploaded from the '/tmp/' directory. This behavior can be indicative of an adversary establishing persistence or executing malicious code.
This rule detects attempts to masquerade as legitimate files on macOS by appending a space to the end of a filename. This technique can trick users and the operating system into executing a malicious file, despite a seemingly benign file extension. The rule specifically looks for process creation events where the command line or the image path ends with a space character.
Detects the execution traces of the WizardUpdate malware, a macOS trojan that attempts to infiltrate macOS machines to steal data and is associated with other types of malicious payloads. The rule specifically looks for shell commands executing `curl` with a specific pattern (`=$(curl ` and `eval`) or `curl` commands containing `_intermediate_agent_`.
This rule detects attempts to collect data from the clipboard on macOS systems by executing the 'osascript' binary with arguments that indicate clipboard interaction. Specifically, it looks for command lines containing 'osascript', ' -e ', and 'clipboard'. This combination suggests an AppleScript or JavaScript for Automation (JXA) command being executed to access clipboard contents.
This rule detects the execution of 'osacompile' with the '-x' and '-e' flags, which indicates the compilation of a run-only AppleScript. Run-only AppleScripts are compiled scripts that cannot be easily decompiled or inspected, making them a potential method for adversaries to obfuscate malicious code and evade analysis. The '-x' flag compiles the script as execute-only, and '-e' specifies the script source.
Detects when the 'firmwarepasswd' utility is executed on macOS with commands to set, delete, or check the firmware password. This activity can indicate an attempt to manipulate the system's firmware security settings, potentially for malicious purposes such as preventing unauthorized OS installations or recovery, or to lock out legitimate users. The rule notes that this command is disabled on Apple Silicon-based Macs.
This rule detects the creation of a property list (.plist) file within the `/Library/StartupItems/` or `/System/Library/StartupItems` directories on macOS. These directories are associated with a deprecated persistence mechanism where files placed within them are automatically executed at boot initialization. Adversaries can leverage this to establish persistence on a compromised system by ensuring their malicious code runs every time the system starts.
Detects attempts to extract credentials from files using the 'grep' command to search for the keyword 'password' or by executing the 'laZagne' credential dumping tool. This rule is specifically tailored for macOS environments.
Detects suspicious child processes spawning from Microsoft Office suite applications (Word, Excel, PowerPoint, OneNote) on macOS. This behavior often indicates malicious macro execution attempting to leverage scripting interpreters or command-line utilities for further compromise.
This rule detects the execution of 'osacompile' and 'curl' in the same command line. This combination is indicative of in-memory downloading and compiling of applets, a technique observed in the XCSSET malware. 'curl' is used to download content, and 'osacompile' is used to compile AppleScript or JavaScript for Automation (JXA) scripts, which can then be executed.
This rule detects DNS queries for specific domains associated with the WannaCry ransomware killswitch. The presence of these queries indicates a potential WannaCry infection attempting to resolve its killswitch domain. If the domain resolves, the ransomware may cease its encryption activities.
Detects additions or modifications to Emond Launch Daemon rule files or client directories, which adversaries may use to gain persistence and elevate privileges on macOS systems. This rule specifically looks for new or changed files in '/etc/emond.d/rules/' (plist files) or '/private/var/db/emondClients/'.
Detects enumeration of local system accounts on macOS using various command-line utilities such as 'dscl', 'dscacheutil', 'cat /etc/passwd', 'id', and 'lsof -u'. This activity is indicative of an adversary attempting to discover existing user accounts on a compromised system.
Page 171 of 174