SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,472 copies16 likes159,584 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects the execution of the "chflags" utility with the "hidden" flag, in order to hide files on MacOS.
When a file or directory has this hidden flag set, it becomes invisible to the default file listing commands and in graphical file browsers.
When a file or directory has this hidden flag set, it becomes invisible to the default file listing commands and in graphical file browsers.
Hidden User Creation
Sigma
Detects creation of a hidden user account on macOS (UserID < 500) or with IsHidden option
Detects disabling security tools
Detects attempts to create and add an account to the admin group via "dscl"
Detects attempts to create and/or add an account to the admin group, thus granting admin privileges.
Detects the execution of the nscurl utility in order to download files.
Detects when the macOS Script Editor utility spawns an unusual child process.
Detects attempts to create and add an account to the admin group via "sysadminctl"
Detects the execution of "sysctl" with specific arguments that have been used by threat actors and malware. It provides system hardware information.
This process is primarily used to detect and avoid virtualization and analysis environments.
This process is primarily used to detect and avoid virtualization and analysis environments.
Detects the use of tail to extract bytes at an offset from an image and then decode the base64 value to create a new file with the decoded content. The detected execution is a bash one-liner.
Page 88 of 680