Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
539 detections
Filters
Last updated
All Time
Detection languages
206
149
53
41
41
Contributors
89
81
81
78
72
Categories
356
200
84
80
73
Platforms
512
43
28
5
5
Products / Services
10,665
9,773
6,704
4,421
3,749
539
MITRE Techniques
212
143
106
104
57
CVEs
5
1
1
1
1
This rule detects potential malicious activity on macOS where a user or script is prompted to open a legitimate-looking application bundle (decoy) while, in close temporal proximity (within 2 minutes), background processes related to hidden .macos payloads or quarantine flag manipulation via 'xattr' are executed. This is a common pattern for malware to appear legitimate to the user while performing malicious setup or persistence in the background.
Detects suspicious command execution patterns commonly associated with ClickFix-style social engineering attacks. The rule identifies Terminal processes executing shell commands that retrieve remote content via curl, followed by base64 decoding and/or piping directly into a shell interpreter (zsh/sh/bash), which is a common technique for executing obfuscated malicious payloads.
This rule detects file-based activity associated with a tool named 'gh-token-monitor', which is likely used for the monitoring or exfiltration of GitHub access tokens from a compromised host. The rule monitors for the creation or presence of specific scripts, configuration files, and directory paths associated with this activity, including files related to a 'claude' configuration.
This rule detects suspicious activity involving common web browser credential files (Cookies, Login Data) being read, created, modified, or renamed by processes associated with iCloud synchronization paths on macOS. This behavior is indicative of potentially malicious processes attempting to exfiltrate browser-stored session information or credentials.
Detects the use of the 'xattr' command to remove the 'com.apple.quarantine' extended attribute from a file. This attribute is used by macOS Gatekeeper to identify files downloaded from the internet and trigger security warnings. Removing it is a common technique to bypass Gatekeeper and execute untrusted software without user notification.
This rule detects the presence or execution of a 'preinstall' script located within a path structure typical of macOS installer packages containing an 'Extra' directory. Such scripts are often used during software installation to perform arbitrary tasks with elevated privileges and may be abused by adversaries for persistence or malicious payload delivery.
Detects attempts to remove the 'com.apple.quarantine' extended attribute from files on macOS using the 'xattr -d' command. This is a common technique used to bypass Gatekeeper's execution restrictions on downloaded files, allowing untrusted applications to run without security warnings.
Detects frequent execution of the 'pbpaste' command on macOS, which is used to read clipboard contents. An unusually high volume of executions within a short window can indicate automated data collection or clipboard monitoring, a common technique for credential harvesting or exfiltration of sensitive information copied by the user.
This rule detects the presence or execution of a 'preinstall' script located within a path structure typical of macOS installer packages containing an 'Extra' directory. Such scripts are often used during software installation to perform arbitrary tasks with elevated privileges and may be abused by adversaries for persistence or malicious payload delivery.
Detects attempts to remove the 'com.apple.quarantine' extended attribute from files on macOS using the 'xattr -d' command. This is a common technique used to bypass Gatekeeper's execution restrictions on downloaded files, allowing untrusted applications to run without security warnings.
Detects frequent execution of the 'pbpaste' command on macOS, which is used to read clipboard contents. An unusually high volume of executions within a short window can indicate automated data collection or clipboard monitoring, a common technique for credential harvesting or exfiltration of sensitive information copied by the user.
This rule detects potential malicious activity on macOS where a user or script is prompted to open a legitimate-looking application bundle (decoy) while, in close temporal proximity (within 2 minutes), background processes related to hidden .macos payloads or quarantine flag manipulation via 'xattr' are executed. This is a common pattern for malware to appear legitimate to the user while performing malicious setup or persistence in the background.
Detects the ProRAM macOS ARM64 Mach-O implant, identified by specific internal codesign strings, download URLs (cloudfront.net/helper), and local file drop paths ($HOME/updated) consistent with the Funnull threat actor's activity.
Detects the creation and immediate deletion of a .dylib file within the 'Library/Application Support/updated/instances/' directory on macOS. This pattern is often associated with the ProRAM technique where a shared library is written to disk, loaded via dlopen, and quickly removed to evade static file-based detection.
Detects ClickFix-style social engineering attacks where users are lured into executing obfuscated commands via terminal copy-paste. The detection monitors for the sequential execution of remote file downloads (e.g., curl, PowerShell) followed immediately by shell history-clearing commands designed to obfuscate the malicious activity. This behavior is associated with macOS crypto-drainers and loaders.
Detects the use of osascript to generate fake macOS system-style dialog boxes that solicit user credentials or administrator privileges. This technique is often employed by macOS infostealers to conduct GUI-based credential harvesting or to bypass user interaction requirements for privilege escalation.
CVE-2026-65400 affects the macOS Screen Sharing service and can allow an attacker on the network to authenticate without valid credentials. Huntress' research goes further, describing the pre-authentication path and opportunities to obtain root-level file access and ultimately code execution. First thing first: patch. Update affected devices to macOS Tahoe 26.6.1, Sequoia 15.7.9, or Sonoma 14.8.9. Apple released these versions on August 6 to address CVE-2026-65400. If patching is not immediately possible, disable Screen Sharing. After patching, we still need to answer the hunter's question: was any of this activity already happening before the update? The KQL below hunts across Microsoft Defender XDR telemetry for activity around the observed attack path: Screen Sharing file activity, SSH sessions, privileged file writes, LaunchDaemon persistence, process masquerading, Packet Filter changes, XMRig artefacts and related network activity. One process particularly worth reviewing is SSFileCopyReceiver / SSFileCopySender. Huntress notes that these are privileged Screen Sharing helpers, and their research highlights root-context activity and filesystem operations as useful hunting opportunities.
Detects the execution of an unsigned binary named '.macos' located within a 'Contents/MacOS/' directory structure, which is a common pattern for malicious applications attempting to masquerade or hide their execution profile on macOS.
Detects the use of 'open' or 'nohup' to execute files located within '/Library/Application Support/' specifically containing 'Extra/preinstall' in the command line. This pattern is often indicative of unauthorized or suspicious execution of installation scripts, potentially used to maintain persistence or execute malicious payloads from non-standard locations on macOS systems.
This rule detects the use of the 'security' command-line utility on macOS to access or dump contents from the login keychain, specifically targeting the 'login.keychain-db' file or attempting to retrieve generic passwords. This behavior is indicative of credential access attempts where an adversary is trying to extract sensitive information, such as passwords or keys, stored within the macOS Keychain.
This rule detects the use of the 'security' command-line utility on macOS to access or dump contents from the login keychain, specifically targeting the 'login.keychain-db' file or attempting to retrieve generic passwords. This behavior is indicative of credential access attempts where an adversary is trying to extract sensitive information, such as passwords or keys, stored within the macOS Keychain.
Page 8 of 26