Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
539 detections
Filters
Last updated
All Time
Detection languages
206
149
53
41
41
Contributors
89
81
81
78
72
Categories
356
200
84
80
73
Platforms
512
43
28
5
5
Products / Services
10,665
9,773
6,704
4,421
3,749
539
MITRE Techniques
212
143
106
104
57
CVEs
5
1
1
1
1
Detects the execution of a command pattern commonly associated with "ClickFix" social engineering attacks. This technique tricks users into pasting a command into their terminal, which typically uses 'echo' to pass a base64 encoded string to the 'base64' utility for decoding, and then pipes the output to a shell for execution. This method is used to bypass traditional OS-level protections like Gatekeeper and Notarization.
Detects malicious activity related to the TCC.db, commonly abused by macOS malware
to bypass Transparency, Consent, and Control (TCC) restrictions.
to bypass Transparency, Consent, and Control (TCC) restrictions.
Detects a sequence of macOS system profiling and software update commands associated with the UNC1069 'ClickFix' social engineering ruse, often followed by a payload download via curl piped to a shell.
Detects the use of 'dscl . authonly' to validate user passwords, a technique
used by the SHub Stealer malware to verify credentials before exfiltration.
The malware typically executes this command from a shell or AppleScript
interpreter.
used by the SHub Stealer malware to verify credentials before exfiltration.
The malware typically executes this command from a shell or AppleScript
interpreter.
Detects a command line pattern where `curl` is used to download a payload, which is then piped to `base64` for decoding and `gunzip` for decompression. This technique is commonly used by macOS infostealers like DigitStealer and MacSync to execute malware in memory without writing it to disk.
Detects the execution of a piped command chain typical of 'ClickFix' lures used by the MacSync infostealer. The malware tricks users into pasting a command into the terminal which uses curl to download a payload, decodes it with base64, and pipes it directly into a shell (zsh, sh) or osascript for execution, bypassing macOS security controls like Gatekeeper.
Detects the creation of a macOS Launch Agent by a suspicious process or with a name matching patterns used by the BlueNoroff group. BlueNoroff uses Launch Agents for persistence on compromised macOS systems.
Detects the DriverFixer0428 macOS credential stealer, attributed to the North Korean 'Contagious Interview' campaign. This rule identifies the malware based on unique internal strings, network IOCs related to Dropbox exfiltration, and social engineering text.
Detects attempts to use system dialog prompts to capture user credentials
Detects the creation of a Launch Agent .plist file used by the DigitStealer malware. This Launch Agent dynamically retrieves its payload from a DNS TXT record, a technique used for resilient persistence.
Detects the creation of malicious disk images (.dmg) or a dropper file (.msi) associated with the DigitStealer macOS infostealer campaign.
Detects the execution of `sysctl` commands querying for specific Apple Silicon M2+ hardware features. This behavior is used by the DigitStealer malware for anti-analysis purposes to evade detection and target specific hardware.
Detects the macOS Script Editor (`Script Editor.app`) launching child processes or initiating network connections. This behavior can indicate the execution of a malicious AppleScript used to download secondary payloads or execute arbitrary commands, as seen in campaigns delivering stealers like MacSync and Odyssey.
Detects attempts to load unsigned kernel extensions, which may indicate rootkit installation or malicious kernel-level access. All legitimate kernel extensions should be signed with a developer ID.
Detects possible malicious execution of JXA in-memory via OSAScript
Detects potential suspicious run-only executions compiled using OSACompile
This rule detects when a user is added to the local 'admin' group on a macOS system using either the `dscl` or `dseditgroup` command-line utilities. It specifically looks for command-line arguments indicative of adding a user to the 'admin' group. There is a whitelist for legitimate MDM solutions like 'jamfmanager' to reduce false positives.
This rule detects attempts to add a user to the 'admin' group on macOS systems using the `dscl` command-line utility. Specifically, it looks for `dscl` commands that include the `-append` option, target the `/Groups/admin` path, and modify `GroupMembership`. This activity is often associated with privilege escalation or persistence by granting administrative rights to a standard user account.
Detects attempts to enable the root account on macOS systems using the 'dsenableroot' command-line utility. This action can be used for persistence, privilege escalation, or defense evasion by adversaries.
This rule detects the use of the PlistBuddy utility to modify LaunchAgents or LaunchDaemons on macOS. Specifically, it looks for command-line arguments that include 'RunAtLoad' and 'true', along with either 'LaunchAgents' or 'LaunchDaemons', indicating an attempt to establish persistence by configuring a program to run automatically at system startup or user login.
The following analytic detects the use of default or publicly known named pipes associated with Cobalt Strike. It leverages Sysmon EventID 17 and 18 to identify specific named pipes commonly used by Cobalt Strike's Artifact Kit and Malleable C2 Profiles. This activity is significant because Cobalt Strike is a popular tool for adversaries to conduct post-exploitation tasks, and identifying its named pipes can reveal potential malicious activity. If confirmed malicious, this could indicate an active Cobalt Strike beacon, leading to unauthorized access, data exfiltration, or further lateral movement within the network.
Page 21 of 26