Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
539 detections
Filters
Last updated
All Time
Detection languages
206
149
53
41
41
Contributors
89
81
81
78
72
Categories
356
200
84
80
73
Platforms
512
43
28
5
5
Products / Services
10,665
9,773
6,704
4,421
3,749
539
MITRE Techniques
212
143
106
104
57
CVEs
5
1
1
1
1
Detects execution patterns associated with the Apple macOS Stealer (AMOS) ClickFix malware, specifically the removal of quarantine attributes and permission modification for a staged 'helper' executable within the /tmp directory, followed by the execution of that binary.
Detects macOS persistence mechanism involving the registration of a disguised LaunchAgent via 'launchctl bootstrap', storing payloads in paths masquerading as system cache directories, and the subsequent removal of the 'com.apple.quarantine' extended attribute using 'xattr' to bypass Gatekeeper execution restrictions.
This rule detects suspicious activity involving common web browser credential files (Cookies, Login Data) being read, created, modified, or renamed by processes associated with iCloud synchronization paths on macOS. This behavior is indicative of potentially malicious processes attempting to exfiltrate browser-stored session information or credentials.
This rule detects the use of the macOS 'xattr' command to remove the 'com.apple.quarantine' extended attribute from files located within '/Library/Application Support/iCloudsync/'. This action is typically performed to bypass macOS Gatekeeper security checks, allowing untrusted binaries or payloads to execute without user confirmation or security prompts.
This rule detects suspicious activity involving common web browser credential files (Cookies, Login Data) being read, created, modified, or renamed by processes associated with iCloud synchronization paths on macOS. This behavior is indicative of potentially malicious processes attempting to exfiltrate browser-stored session information or credentials.
This rule detects the use of the macOS 'xattr' command to remove the 'com.apple.quarantine' extended attribute from files located within '/Library/Application Support/iCloudsync/'. This action is typically performed to bypass macOS Gatekeeper security checks, allowing untrusted binaries or payloads to execute without user confirmation or security prompts.
This rule detects attempts to bypass macOS Gatekeeper security controls by disabling security policies via the 'spctl' command, or by removing file quarantine attributes using the 'xattr' utility. These techniques are commonly used to execute unauthorized or malicious software that would otherwise be blocked by macOS security features.
Detects the creation, modification, or renaming of .plist files within the /Library/LaunchAgents/ directory on macOS. This directory is a common location used by adversaries to establish persistence, as files placed here are automatically loaded and executed by the system upon user login.
This rule detects the launch of the Terminal application (Terminal.app) on macOS when initiated by a web browser process such as Safari, Chrome, Firefox, or Microsoft Edge. This behavior is indicative of a potential drive-by download attack or a malicious file execution sequence (e.g., ClickLock stealer) where browser-based interactions lead to the execution of system-level command line interfaces.
This rule detects the use of the 'xattr' utility to remove the 'com.apple.quarantine' extended attribute from files located in '/tmp/'. Removing this attribute is a common technique used by attackers to bypass macOS Gatekeeper security controls, allowing unauthorized or malicious applications to execute without user prompts.
Detects suspicious execution patterns in Unix-based shells (sh, bash, zsh) where commands are obfuscated using base64, openssl, or gunzip and then executed via 'eval'. The command further includes indicators of manual execution or persistence, such as 'printf', 'xattr', or immediate permission changes ('chmod +x'). This pattern is frequently observed in the delivery of multi-stage payloads, fileless malware, or initial entry stagers.
Detects the creation of .plist files in sensitive directories used by macOS launchd for automatic execution (LaunchAgents and LaunchDaemons). Adversaries use these locations to establish persistence by ensuring malicious code or scripts are executed at startup or upon user login.
Detects the execution of various command-line tools (sc, net, powershell, wmic, taskkill, systemctl, launchctl) used to stop or disable system services. This behavior is often associated with adversaries attempting to stop security services, backup agents, or other critical infrastructure for impact, defense evasion, or prior to data destruction.
Detects the parsing of Mach-O headers for files with specific, potentially anomalous extensions. This is often used to identify masqueraded executables, unsigned binaries, or files with suspicious RPath configurations that may indicate malicious activity.
Detects modifications to the Transparency, Consent, and Control (TCC) database on macOS. The rule categorizes activity based on the file path (system-wide or user-specific) and the user account performing the modification, identifying potentially unauthorized changes to application privacy permissions.
This rule detects the use of 'osascript' on macOS to generate a fake credential prompt dialog. It specifically looks for AppleScript commands containing keywords such as 'display dialog', 'password', and either 'with hidden answer' or 'Enter your password'. This behavior is characteristic of an adversary attempting to phish user credentials by presenting a legitimate-looking prompt.
This rule detects potential attempts to bypass macOS Gatekeeper security checks by identifying the removal of the 'com.apple.quarantine' extended attribute using the 'xattr' utility, or by changing file permissions using 'chmod' on files marked with the 'com.apple.verified' attribute. Adversaries use these techniques to ensure malicious or untrusted binaries execute without user prompts or security warnings.
This rule detects unauthorized or unexpected processes accessing sensitive browser data files, specifically 'Login Data' (password databases) and 'Cookies' files, located in standard macOS browser paths for Google Chrome and Firefox. By excluding legitimate browser and system update processes, the rule identifies potential credential dumping or session hijacking attempts.
Detects a sequence of events where a user visits a known ClickFix Traffic Direction System (TDS) domain and subsequently executes an obfuscated 'curl' command via the Terminal application on macOS. This pattern is indicative of a ClickFix campaign where users are socially engineered into pasting malicious code snippets to resolve fake browser errors.
This rule detects execution of macOS processes that contain specific strings associated with cryptocurrency wallet-draining malware (e.g., 'DRAIN_PCT', 'DRAIN_FUNCTION'). It monitors process creation command-line arguments to identify attempts by malicious software to execute functions intended to empty victim crypto wallets.
Detects a rapid multi-stage infection chain on macOS, typically associated with the ClickFix campaign. The rule monitors for a sequence of process events starting from a shell, followed by a curl-based download, data decoding via base64 or openssl, execution of the decoded content via shell/python/perl, and finally persistence mechanisms using launchctl or osascript, all occurring within 28 seconds.
Page 9 of 26