Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
539 detections
Filters
Last updated
All Time
Detection languages
206
149
53
41
41
Contributors
89
81
81
78
72
Categories
356
200
84
80
73
Platforms
512
43
28
5
5
Products / Services
10,665
9,773
6,704
4,421
3,749
539
MITRE Techniques
212
143
106
104
57
CVEs
5
1
1
1
1
Detects a Bash stager script associated with the AMOS (Atomic macOS Stealer) 'ClickFix' campaign. The script performs system architecture verification to download a specific Mach-O payload, makes the downloaded file executable using chmod, and subsequently executes the payload.
Detects execution of encoded commands in macOS terminal environments that originate from clipboard content mimicking a reCAPTCHA verification process. This pattern often involves users being social-engineered into pasting a malicious string that decodes a payload and pipes it directly into a shell interpreter (sh/bash/zsh). The rule monitors for the co-occurrence of base64/openssl decoding commands and shell execution pipes, while filtering out known legitimate software installation patterns.
Detects execution of encoded commands in macOS terminal environments that originate from clipboard content mimicking a reCAPTCHA verification process. This pattern often involves users being social-engineered into pasting a malicious string that decodes a payload and pipes it directly into a shell interpreter (sh/bash/zsh). The rule monitors for the co-occurrence of base64/openssl decoding commands and shell execution pipes, while filtering out known legitimate software installation patterns.
Detects architecture-specific Mach-O 64-bit AMOS Stealer binaries dropped by the Macfinger ClickFix first-stage shell script, requiring multiple distinctive C2 endpoint strings alongside Mach-O magic and size constraints to reduce false positives
Detects architecture-specific Mach-O 64-bit AMOS Stealer binaries dropped by the Macfinger ClickFix first-stage shell script, requiring multiple distinctive C2 endpoint strings alongside Mach-O magic and size constraints to reduce false positives
Detects architecture-specific Mach-O 64-bit AMOS Stealer binaries dropped by the Macfinger ClickFix first-stage shell script, requiring multiple distinctive C2 endpoint strings alongside Mach-O magic and size constraints to reduce false positives
Detects the use of download utilities (curl or wget) from terminal shells with command-line arguments containing 'force=1' and architecture-specific identifiers (e.g., arm64, x86_64). This pattern matches the execution chain commonly associated with ClickFix-based AMOS malware distribution, where users are tricked into pasting commands to download and execute architecture-specific payloads.
Detects the use of download utilities (curl or wget) from terminal shells with command-line arguments containing 'force=1' and architecture-specific identifiers (e.g., arm64, x86_64). This pattern matches the execution chain commonly associated with ClickFix-based AMOS malware distribution, where users are tricked into pasting commands to download and execute architecture-specific payloads.
Detects the use of download utilities (curl or wget) from terminal shells with command-line arguments containing 'force=1' and architecture-specific identifiers (e.g., arm64, x86_64). This pattern matches the execution chain commonly associated with ClickFix-based AMOS malware distribution, where users are tricked into pasting commands to download and execute architecture-specific payloads.
Detects the use of download utilities (curl or wget) from terminal shells with command-line arguments containing 'force=1' and architecture-specific identifiers (e.g., arm64, x86_64). This pattern matches the execution chain commonly associated with ClickFix-based AMOS malware distribution, where users are tricked into pasting commands to download and execute architecture-specific payloads.
Detects the execution of base64-encoded shell commands on macOS, a pattern commonly associated with the 'ClickFix' social engineering campaign where users are tricked into copying and pasting malicious payloads into their Terminal.
Detects execution of curl piping to a shell interpreter (bash, zsh, sh) initiated directly from macOS Terminal or iTerm2. This pattern is characteristic of ClickFix-style social engineering attacks, where a user is prompted to copy and paste a malicious command into their terminal, which then downloads and executes a secondary stage, such as the Atomic macOS (AMOS) stealer.
Detects the deletion of suspicious files associated with macOS malware families commonly referred to as FLATROOF or ROOFDECK. The rule monitors for the removal of files located in specific directories ('com.apple.iTunesCloud/SystemUpdate' or 'com.apple.internal.ck/iSync') using system utilities like 'rm' or via the 'loginwindow' process, which is indicative of malware attempting to clean its tracks after execution or persistence.
Detects network connections to known FLATROOF and ROOFDECK C2 infrastructure used by Jade Sleet/TraderTraitor (UNC4899, Lazarus) in campaigns targeting IT services and DevOps engineers.
Detects the execution of binaries or scripts named with keywords related to AI agent plugins (e.g., 'skill', 'plugin', 'mcp-server') from potentially untrusted locations like Downloads or Temp folders. The rule further correlates this execution with post-exploitation indicators such as persistence establishment (registry keys, scheduled tasks, launch agents) or outbound network activity.
Detects the execution of an unsigned, non-Apple binary initiated via xpcproxy that subsequently loads 'libpam.2.dylib' within a two-minute window. This behavior is indicative of a PamStealer-style attack, where a malicious or spoofed process attempts to harvest user credentials by leveraging system PAM libraries for validation.
Detects the execution of an unsigned, non-Apple binary initiated via xpcproxy that subsequently loads 'libpam.2.dylib' within a two-minute window. This behavior is indicative of a PamStealer-style attack, where a malicious or spoofed process attempts to harvest user credentials by leveraging system PAM libraries for validation.
Detects the execution of an unsigned, non-Apple binary initiated via xpcproxy that subsequently loads 'libpam.2.dylib' within a two-minute window. This behavior is indicative of a PamStealer-style attack, where a malicious or spoofed process attempts to harvest user credentials by leveraging system PAM libraries for validation.
Detects the execution of an unsigned, non-Apple binary initiated via xpcproxy that subsequently loads 'libpam.2.dylib' within a two-minute window. This behavior is indicative of a PamStealer-style attack, where a malicious or spoofed process attempts to harvest user credentials by leveraging system PAM libraries for validation.
Detects the execution of an unsigned, non-Apple binary initiated via xpcproxy that subsequently loads 'libpam.2.dylib' within a two-minute window. This behavior is indicative of a PamStealer-style attack, where a malicious or spoofed process attempts to harvest user credentials by leveraging system PAM libraries for validation.
This rule detects suspicious activity involving macOS LaunchAgents and files within the 'Application Support/System' directory, often associated with persistence or malicious background execution. The detection looks for the creation or modification of specific plist files (e.g., com.apple.finder.agent.plist) or git-related files in Application Support, correlated with process execution of commands like 'sysnotif-repair', 'launchctl' manipulating agents, or git operations involving custom hooks paths.
Page 3 of 26