Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
1
1
Contributors
1
1
Categories
2
1
1
Platforms
2
1
Products / Services
1
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
Detects the use of 'rm' or 'unlink' commands to forcefully delete specific files or directories within the '/tmp' directory. The targeted files/directories ('osalogging.zip', '/tmp/sync', '/tmp/macsync_') could indicate cleanup activities after a malicious operation or system compromise, potentially related to macOS systems.
This rule detects the execution of 'osacompile' with the '-x' and '-e' flags, which indicates the compilation of a run-only AppleScript. Run-only AppleScripts are compiled scripts that cannot be easily decompiled or inspected, making them a potential method for adversaries to obfuscate malicious code and evade analysis. The '-x' flag compiles the script as execute-only, and '-e' specifies the script source.
