Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
539 detections
Filters
Last updated
All Time
Detection languages
206
149
53
41
41
Contributors
89
81
81
78
72
Categories
356
200
84
80
73
Platforms
512
43
28
5
5
Products / Services
10,665
9,773
6,705
4,421
3,749
539
MITRE Techniques
212
143
106
104
57
CVEs
5
1
1
1
1
Detects macOS system fingerprinting targeting IOPlatformUUID using the ioreg command. This technique was observed being used by the FlutterShell malware (Operation FlutterBridge) to uniquely identify victims upon installation.
Detects the creation or modification of specific LaunchAgent plist files used by JINX-0164's AUDIOFIX and MINIRAT malware for persistence on macOS. The rule monitors for file creation, renaming, or modification events within the /Library/LaunchAgents/ directory, specifically targeting plist files with names known to be used by this malware.
Detects the use of launchctl submit to establish persistence on macOS.
Unlike the more common LaunchAgent/LaunchDaemon plist approach, launchctl
submit registers a job directly via the command line without creating a
plist file on disk, making it harder to discover through filesystem
sweeps. This technique is used by JINX-0164 (Wiz CIRT) to persist
AUDIOFIX and MINIRAT payloads with job labels like chrome.job and
coreaudio.job, but the technique itself is rare in legitimate software.
The rule catches any launchctl submit invocation and flags known
JINX-0164 job labels for high-confidence triage.
Unlike the more common LaunchAgent/LaunchDaemon plist approach, launchctl
submit registers a job directly via the command line without creating a
plist file on disk, making it harder to discover through filesystem
sweeps. This technique is used by JINX-0164 (Wiz CIRT) to persist
AUDIOFIX and MINIRAT payloads with job labels like chrome.job and
coreaudio.job, but the technique itself is rare in legitimate software.
The rule catches any launchctl submit invocation and flags known
JINX-0164 job labels for high-confidence triage.
Detects the exploitation primitive of CVE-2026-3102 at the post-injection execution layer. The exploit succeeds when exiftool constructs a /usr/bin/setfile command line containing attacker-injected shell metacharacters (single quotes for command injection, backticks or $() for command substitution, semicolons for command chaining). Detecting setfile invocations spawned by exiftool with these characters in arguments is the smoking-gun signal. Even future variants of this vulnerability class (or related n-day exploits in the same family) would produce this same parent/child + metacharacter pattern.
Detects modifications to the OpenClaw agent's SOUL.md file, which dictates the core behavior and instructions of the agent. Attackers exploit this by tampering with the file to persistently alter the agent's actions across all future sessions without needing traditional code execution, as seen in attacks against NVIDIA NemoClaw sandboxes.
Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This rule detect using dd and truncate to add a junk data to file.
Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.
Detects attempts to masquerade as legitimate files by adding a space to the end of the filename.
Detects the execution of a renamed instance of the Remote Monitoring and Management (RMM) tool, MeshAgent.
RMM tools such as MeshAgent are commonly utilized by IT administrators for legitimate remote support and system management.
However, malicious actors may exploit these tools by renaming them to bypass detection mechanisms, enabling unauthorized access and control over compromised systems.
RMM tools such as MeshAgent are commonly utilized by IT administrators for legitimate remote support and system management.
However, malicious actors may exploit these tools by renaming them to bypass detection mechanisms, enabling unauthorized access and control over compromised systems.
Detects macOS Gatekeeper bypass via xattr utility
Detects deletion of local audit logs
Detects attempts to enable the guest account using the sysadminctl utility
Detects the execution of "system_profiler" with specific "Data Types" that have been seen being used by threat actors and malware. It provides system hardware and software configuration information.
This process is primarily used for system information discovery. However, "system_profiler" can also be used to determine if virtualization software is being run for defense evasion purposes.
This process is primarily used for system information discovery. However, "system_profiler" can also be used to determine if virtualization software is being run for defense evasion purposes.
Detects usage of base64 utility to decode arbitrary base64-encoded text
Detect file time attribute change to hide new or changes to existing files
Detects attempts to enable the root account via "dsenableroot"
Detects attempts to manually remove the Apple quarantine extended
attribute using the xattr utility. This technique is often used by malware,
such as the notnullOSX stealer, to bypass macOS Gatekeeper protections on
downloaded payloads.
attribute using the xattr utility. This technique is often used by malware,
such as the notnullOSX stealer, to bypass macOS Gatekeeper protections on
downloaded payloads.
Detects the execution of the "chflags" utility with the "hidden" flag, in order to hide files on MacOS.
When a file or directory has this hidden flag set, it becomes invisible to the default file listing commands and in graphical file browsers.
When a file or directory has this hidden flag set, it becomes invisible to the default file listing commands and in graphical file browsers.
Hidden User Creation
Sigma
Detects creation of a hidden user account on macOS (UserID < 500) or with IsHidden option
Detects disabling security tools
Detects attempts to create and add an account to the admin group via "dscl"
Page 19 of 26