Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
539 detections
Filters
Last updated
All Time
Detection languages
206
149
53
41
41
Contributors
89
81
81
78
72
Categories
356
200
84
80
73
Platforms
512
43
28
5
5
Products / Services
10,665
9,773
6,704
4,421
3,749
539
MITRE Techniques
212
143
106
104
57
CVEs
5
1
1
1
1
Detects enumeration of local or remote network services.
Detects architecture-specific Mach-O 64-bit AMOS Stealer binaries dropped by the Macfinger ClickFix first-stage shell script, requiring multiple distinctive C2 endpoint strings alongside Mach-O magic and size constraints to reduce false positives
Detects execution of encoded commands in macOS terminal environments that originate from clipboard content mimicking a reCAPTCHA verification process. This pattern often involves users being social-engineered into pasting a malicious string that decodes a payload and pipes it directly into a shell interpreter (sh/bash/zsh). The rule monitors for the co-occurrence of base64/openssl decoding commands and shell execution pipes, while filtering out known legitimate software installation patterns.
Detects potential 'ClickFix' activity where a browser or file explorer process initiates a shell (e.g., cmd, powershell, osascript) with command arguments indicative of remote script execution, obfuscated commands, or web-based payload downloading. This pattern matches known social engineering tactics that entice users to copy-paste malicious code into a system shell.
Detects instances where the 'curl' utility is used to download files while simultaneously piping the output directly into a shell interpreter (bash/sh) or using download flags ('-o', '-O') in a way that suggests staging or immediate execution of remote scripts, often associated with force-flag bypass patterns.
Detects the execution of bash commands that contain base64 decoding flags, typically used to obfuscate command-line arguments to evade detection, initiated from a terminal application.
Detects suspicious execution patterns on macOS where the Terminal application launches a bash process executing base64-encoded commands. This behavior is indicative of the ClickFix campaign, where users are prompted to copy and paste malicious obfuscated scripts into the terminal, often under the guise of a reCAPTCHA verification.
Detects specific malicious Mach-O binary payloads associated with the Atomic macOS Stealer (AMOS) discovered in the Macfinger ClickFix campaign. The rule uses static file hashes to identify these specific samples.
This rule detects activities associated with the MacSync backdoor, specifically focusing on persistence mechanisms such as LaunchAgent manipulation, .repair-run scripts, and suspicious GIT hook usage. It also correlates these events with the termination of macOS notification agents (BTMNotificationAgent, NotificationCenter, BackgroundTaskManagementAgent), which is a tactic used to suppress security alerts during malicious operations.
Detects the use of download utilities (curl or wget) from terminal shells with command-line arguments containing 'force=1' and architecture-specific identifiers (e.g., arm64, x86_64). This pattern matches the execution chain commonly associated with ClickFix-based AMOS malware distribution, where users are tricked into pasting commands to download and execute architecture-specific payloads.
Detects potential 'ClickFix' activity where a browser or file explorer process initiates a shell (e.g., cmd, powershell, osascript) with command arguments indicative of remote script execution, obfuscated commands, or web-based payload downloading. This pattern matches known social engineering tactics that entice users to copy-paste malicious code into a system shell.
This rule detects the 'ClickFix' attack pattern, where an adversary tricks a user into copying and pasting a malicious command into a terminal. The command typically involves using 'base64 -D' to decode an attacker-supplied blob directly into a bash interpreter, often initiated by a Terminal emulator and containing strings related to fake reCAPTCHA or robot verification.
Detects architecture-specific Mach-O 64-bit AMOS Stealer binaries dropped by the Macfinger ClickFix first-stage shell script, requiring multiple distinctive C2 endpoint strings alongside Mach-O magic and size constraints to reduce false positives
Detects the modification or creation of a 'loginwindow.plist' file within the '/Library/LaunchAgents/' directory, correlated with a process containing 'renderer' and 'launchctl' or 'LaunchAgents' in its command line. This pattern suggests potential persistence mechanisms being established by a renderer process (e.g., an Electron-based application or browser process).
This rule detects suspicious activity involving macOS LaunchAgents and files within the 'Application Support/System' directory, often associated with persistence or malicious background execution. The detection looks for the creation or modification of specific plist files (e.g., com.apple.finder.agent.plist) or git-related files in Application Support, correlated with process execution of commands like 'sysnotif-repair', 'launchctl' manipulating agents, or git operations involving custom hooks paths.
Detects PamStealer-style browser credential theft on macOS. The detection logic identifies the forced termination of browser helper processes using 'pkill' (which releases SQLite file locks) followed by the execution of a 'KcHelper' binary that uses specific environment markers (e.g., KC_PASS) to bypass keychain authorization prompts and steal stored browser credentials.
This rule detects activities associated with the MacSync backdoor, specifically focusing on persistence mechanisms such as LaunchAgent manipulation, .repair-run scripts, and suspicious GIT hook usage. It also correlates these events with the termination of macOS notification agents (BTMNotificationAgent, NotificationCenter, BackgroundTaskManagementAgent), which is a tactic used to suppress security alerts during malicious operations.
Detects process execution attempts where the binary is located in specific, non-standard macOS system library paths often associated with background tasks or masquerading, specifically when the process is invoked with a '--type=renderer' command-line argument. This is a common pattern for malicious code attempting to mimic browser-based or helper processes.
Detects the execution of zsh with potentially suspicious command-line arguments (e.g., usage of curl, pipes, or osascript) occurring within a 15-minute window of network activity connecting to iCloud CalDAV servers. This behavior pattern may indicate unauthorized data access or exfiltration via legitimate cloud services.
Detects the creation of a suspicious 'com.apple.finder.agent' plist file within a user LaunchAgents directory followed shortly by the termination of known macOS notification and background management agents. This pattern is often associated with malware attempting to evade detection or manipulate user notifications by disabling system components.
This rule detects a sequence of events indicative of MacSync credential phishing on macOS. It identifies the tampering of Pluggable Authentication Modules (PAM) configuration files or SecurityAgent plugins (often used to hook authentication processes), immediately followed by the use of osascript to display a spoofed password dialog to the user. This combined activity suggests an adversary is attempting to harvest local user account credentials.
Page 1 of 26