macOS Emond Rule Created for Persistence
This rule detects the creation of an Emond rule on macOS systems, which can be used for persistence. It specifically looks for network traffic containing the string "/etc/emond.d/" in a TCP flow to a server on port 22 (SSH). This indicates an attempt to establish or modify an Emond rule, which allows for scheduled execution of commands or scripts.
Suricata
