Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,100 downloads4,386 copies51 likes26,183 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
This rule detects suspicious activity involving macOS LaunchAgents and files within the 'Application Support/System' directory, often associated with persistence or malicious background execution. The detection looks for the creation or modification of specific plist files (e.g., com.apple.finder.agent.plist) or git-related files in Application Support, correlated with process execution of commands like 'sysnotif-repair', 'launchctl' manipulating agents, or git operations involving custom hooks paths.
This rule detects suspicious activity involving macOS LaunchAgents and files within the 'Application Support/System' directory, often associated with persistence or malicious background execution. The detection looks for the creation or modification of specific plist files (e.g., com.apple.finder.agent.plist) or git-related files in Application Support, correlated with process execution of commands like 'sysnotif-repair', 'launchctl' manipulating agents, or git operations involving custom hooks paths.
This rule detects suspicious activity involving macOS LaunchAgents and files within the 'Application Support/System' directory, often associated with persistence or malicious background execution. The detection looks for the creation or modification of specific plist files (e.g., com.apple.finder.agent.plist) or git-related files in Application Support, correlated with process execution of commands like 'sysnotif-repair', 'launchctl' manipulating agents, or git operations involving custom hooks paths.
This rule detects suspicious activity involving macOS LaunchAgents and files within the 'Application Support/System' directory, often associated with persistence or malicious background execution. The detection looks for the creation or modification of specific plist files (e.g., com.apple.finder.agent.plist) or git-related files in Application Support, correlated with process execution of commands like 'sysnotif-repair', 'launchctl' manipulating agents, or git operations involving custom hooks paths.
This rule detects the use of the macOS 'security' utility to unlock the login keychain and modify its access-control list, a technique observed in PamStealer malware to facilitate subsequent unauthorized access to the keychain database.
This rule detects the use of the macOS 'security' utility to unlock the login keychain and modify its access-control list, a technique observed in PamStealer malware to facilitate subsequent unauthorized access to the keychain database.
This rule detects the use of the macOS 'security' utility to unlock the login keychain and modify its access-control list, a technique observed in PamStealer malware to facilitate subsequent unauthorized access to the keychain database.
Detects PamStealer-style browser credential theft on macOS. The detection logic identifies the forced termination of browser helper processes using 'pkill' (which releases SQLite file locks) followed by the execution of a 'KcHelper' binary that uses specific environment markers (e.g., KC_PASS) to bypass keychain authorization prompts and steal stored browser credentials.
Detects PamStealer-style browser credential theft on macOS. The detection logic identifies the forced termination of browser helper processes using 'pkill' (which releases SQLite file locks) followed by the execution of a 'KcHelper' binary that uses specific environment markers (e.g., KC_PASS) to bypass keychain authorization prompts and steal stored browser credentials.
Detects PamStealer-style browser credential theft on macOS. The detection logic identifies the forced termination of browser helper processes using 'pkill' (which releases SQLite file locks) followed by the execution of a 'KcHelper' binary that uses specific environment markers (e.g., KC_PASS) to bypass keychain authorization prompts and steal stored browser credentials.
Page 291 of 756