Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
539 detections
Filters
Last updated
All Time
Detection languages
206
149
53
41
41
Contributors
89
81
81
78
72
Categories
356
200
84
80
73
Platforms
512
43
28
5
5
Products / Services
10,665
9,773
6,704
4,421
3,749
539
MITRE Techniques
212
143
106
104
57
CVEs
5
1
1
1
1
This rule detects attempts to enumerate remote systems on a macOS host using the 'arp' and 'ping' utilities. Specifically, it looks for 'arp -a' commands, which list all current ARP entries, and 'ping' commands targeting common private IP address ranges (10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12) as well as localhost (127.0.0.0/8) and APIPA (169.254.0.0/16) ranges. This activity is indicative of an adversary performing network discovery to identify other systems for potential lateral movement.
This rule detects when the macOS Script Editor application spawns child processes that are commonly used for malicious activities. Specifically, it looks for the Script Editor launching shell interpreters (bash, sh, zsh, dash, fish), scripting languages (python, perl, php, osascript), or utilities often leveraged in attack chains (curl, mktemp, chmod, nohup, openssl, plutil, PlistBuddy, xattr, sqlite, funzip, popen). This behavior can indicate an adversary using AppleScript or other scripting capabilities within Script Editor to execute arbitrary commands, download payloads, or manipulate system configurations.
Detects attempts to extract credentials from macOS Keychain using the 'security' command-line utility. This rule specifically looks for the use of 'security' with arguments like 'find-certificate', 'export', 'dump-keychain', or 'login-keychain', which are commonly used to access or dump Keychain contents.
Detects enumeration of local system groups on macOS using common command-line utilities such as `dscacheutil`, `cat`, and `dscl`. This activity is often performed by adversaries during the discovery phase to identify privileged accounts or groups for lateral movement or privilege escalation.
This rule detects attempts to masquerade as legitimate files on macOS by appending a space to the end of a filename. This technique can trick users and the operating system into executing a malicious file, despite a seemingly benign file extension. The rule specifically looks for process creation events where the command line or the image path ends with a space character.
Detects suspicious child processes spawning from Microsoft Office suite applications (Word, Excel, PowerPoint, OneNote) on macOS. This behavior often indicates malicious macro execution attempting to leverage scripting interpreters or command-line utilities for further compromise.
Detects enumeration of local system accounts on macOS using various command-line utilities such as 'dscl', 'dscacheutil', 'cat /etc/passwd', 'id', and 'lsof -u'. This activity is indicative of an adversary attempting to discover existing user accounts on a compromised system.
Detects suspicious child processes spawned from web browsers on macOS. This activity often indicates a potential web browser exploitation attempt, where an attacker leverages a browser vulnerability to execute arbitrary commands or scripts on the system. The rule specifically looks for common scripting and command-line interpreters being launched as child processes of various browsers, while filtering out known legitimate browser-related activities like updates or recovery scripts.
Detects additions to the Emond Launch Daemon that adversaries may use to gain persistence and elevate privileges.
Detects the usage of tooling to sniff network traffic.
An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
Detection use of the command "split" to split files into parts and possible transfer.
Detects commandline operations on shell history files
Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.
JAMF MDM Execution
Sigma
Detects execution of the "jamf" binary to create user accounts and run commands. For example, the binary can be abused by attackers on the system in order to bypass security controls or remove application control polices.
Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detection will focus on crontab jobs uploaded from the tmp folder.
Detects attempts to use screencapture to collect macOS screenshots
Detects usage of "find" binary in a suspicious manner to perform discovery
Identifies the execution traces of the XCSSET malware. XCSSET is a macOS trojan that primarily spreads via Xcode projects and maliciously modifies applications. Infected users are also vulnerable to having their credentials, accounts, and other vital data stolen.
Detects the creation of a startup item plist file, that automatically get executed at boot initialization to establish persistence.
Adversaries may use startup items automatically executed at boot initialization to establish persistence.
Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items.
Adversaries may use startup items automatically executed at boot initialization to establish persistence.
Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items.
Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.
Detects passwords dumps from Keychain
Page 25 of 26