Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
539 detections
Filters
Last updated
All Time
Detection languages
206
149
53
41
41
Contributors
89
81
81
78
72
Categories
356
200
84
80
73
Platforms
512
43
28
5
5
Products / Services
10,665
9,773
6,705
4,421
3,749
539
MITRE Techniques
212
143
106
104
57
CVEs
5
1
1
1
1
Detects the removal of known Amos Stealer staging artifacts, specifically the 'osalogging.zip' file or 'sync' directories within the /tmp folder. This behavior indicates post-exfiltration cleanup to evade detection.
Detects the use of curl with specific command-line flags (-kfsSL) commonly used by Amos Stealer to silently download its initial payload, bypassing TLS warnings and hiding output. This behavior is indicative of an adversary attempting to transfer tools or malware onto a system without user interaction or visible output.
This rule detects attempts to clean up artifacts associated with the Amos Stealer by monitoring for the deletion of known staging paths. Specifically, it looks for the execution of 'rm' commands targeting '/tmp/osalogging.zip' or '/tmp/sync'. This activity suggests an adversary is trying to remove traces of their presence after data exfiltration or staging.
Detects ptrace access to securityd process memory for credential extraction
Hidden User Use Case Monitors dslocal user plist modifications for IsHidden, indicating a concealed local account created or modified outside standard account management workflows.
Detects the use of curl to download files from Telegram to local temp folder, which may indicate initial malware staging.
Detects the initial execution phase of the Phantom Gyp technique where a node-gyp rebuild command is abused to execute a silent payload and return a fake C stub file. This behavior is associated with the Miasma npm supply chain attack.
Detects setting IsHidden on a macOS user record to suppress the account from the login screen.
Maps to Atomic Red Team test "Create Hidden User using IsHidden option" (T1564.002).
Maps to Atomic Red Team test "Create Hidden User using IsHidden option" (T1564.002).
Detects the execution of commands indicative of a user pasting a malicious script into the Terminal, often associated with ClickFix or fake CAPTCHA social engineering attacks. This typically involves using tools like `curl` to download and pipe payloads directly to a shell, or the use of `pbpaste` to execute clipboard contents.
Hidden User Use Case Monitors dslocal user plist modifications for IsHidden, indicating a concealed local account created or modified outside standard account management workflows.
Detects hiding a user home folder with chflags, complementing account-level hiding
documented in T1564.002.
documented in T1564.002.
Detects access to clipboard content via osascript, which may be used for data collection but also occurs in legitimate clipboard utilities and automation scripts
Detects the creation or modification of specific LaunchAgent plist files used by the arm64 and x86_64 variants of SStar Agent malware on macOS for persistence. The rule looks for file events (creation, modification, rename) within the /Library/LaunchAgents/ directory, specifically targeting 'com.wpnuersvc.agent.plist' and 'com.googleupdate.sstaragent.plist' filenames.
Detects delete/create sequences on the same /Users/ path within a short time window,
consistent with account attribute laundering during hidden user setup.
consistent with account attribute laundering during hidden user setup.
Detects command-line attempts to access, dump, or export macOS Keychain data using the 'security' utility. This behavior is commonly exhibited by infostealers, such as MacSync Stealer, targeting saved passwords, cryptocurrency wallets, and developer credentials.
Detects enabling Hide500Users in com.apple.loginwindow preferences, which suppresses
sub-500 UID accounts from the login screen and System Settings.
sub-500 UID accounts from the login screen and System Settings.
Detects uncommon or suspicious child processes spawning from a VsCode process. This could indicate an attempt of persistence via VsCode tasks or terminal profiles.
Detects the execution of curl on macOS using a hardcoded Catalina user agent (Mac OS X 10_15_7) and silent/fail-fast flags (-fsSL). This pattern correlates with the macOS terminal payload delivery mechanism used in the ClearFake/ClickFix campaign.
Detects execution of AppleScript of the macOS scripting language AppleScript.
Detects macOS system fingerprinting targeting IOPlatformUUID using the ioreg command. This technique was observed being used by the FlutterShell malware (Operation FlutterBridge) to uniquely identify victims upon installation.
Detects suspicious execution of the 'open' command targeting the Sparkle framework's installation cache directory on macOS. This activity could indicate the use of a backdoor like FlutterShell attempting to silently update or execute malicious code via a legitimate update mechanism.
Page 18 of 26