Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,647 detections
Filters
Last updated
All Time
Detection languages
1,768
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,502
1,169
782
528
521
Platforms
39,936
7,266
6,537
3,866
3,647
Products / Services
807
512
432
340
300
MITRE Techniques
1,180
582
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Domain Prevalence
YARA-L
Detects DNS events querying domains that have a low rolling max prevalence.
DNS query to a recently created domain
Detects when a low prevalence hash is seen during a process launch event, and a low prevalence domain is accessed within 10m.
Detects the use of 'tail' to extract bytes at an offset from an image file (e.g., JPEG, PNG) and then pipe the output to 'base64 --decode' to create a new file with the decoded content. This technique is often used by adversaries to deobfuscate or extract hidden payloads from seemingly innocuous image files, typically executed as a bash one-liner.
This rule detects the execution of the `system_profiler` utility on macOS when specific data types are requested. These data types (SPApplicationsDataType, SPHardwareDataType, SPNetworkDataType, SPUSBDataType) have been observed in use by threat actors and malware for system information discovery and potentially for defense evasion by checking for virtualization software. The `system_profiler` command provides detailed hardware and software configuration information about the system.
Detects the use of `csrutil` with the `status` argument to view the System Integrity Protection (SIP) status on macOS. This activity is often observed in post-exploitation scenarios where an adversary is attempting to understand the system's security posture, specifically whether SIP is enabled or disabled, which could impact their ability to perform certain actions like modifying system files or injecting code.
This rule detects the use of the `ioreg` command-line utility on macOS, which is used to display I/O Kit registry information. Adversaries often use `ioreg` for system information discovery, particularly to identify virtualization environments (e.g., VirtualBox, VMware, Parallels) or other system details like serial numbers or USB device information. The rule specifically looks for executions of `ioreg` combined with common arguments and keywords used for such discovery, either directly or through shell commands involving `grep`.
Detects when the `csrutil` command is used with the `disable` argument to turn off System Integrity Protection (SIP) on macOS. This action is often performed in post-exploitation scenarios by adversaries to gain greater control over the system or to bypass security mechanisms.
This rule detects the execution of the 'sw_vers' command-line utility on macOS systems when specific arguments are used to query system information. The arguments monitored include '-buildVersion', '-productName', and '-productVersion', which are commonly used for system information discovery.
Detects suspicious DNS queries to Monero mining pools
Detects the use of csrutil to disable the Configure System Integrity Protection (SIP). This technique is used in post-exploit scenarios.
Detects the use of csrutil to view the Configure System Integrity Protection (SIP) status. This technique is used in post-exploit scenarios.
Detects the use of "ioreg" which will show I/O Kit registry information.
This process is used for system information discovery.
It has been observed in-the-wild by calling this process directly or using bash and grep to look for specific strings.
This process is used for system information discovery.
It has been observed in-the-wild by calling this process directly or using bash and grep to look for specific strings.
Detects the use of "sw_vers" for system information discovery
Detects the execution of common macOS command-line utilities used for enumerating local network configuration and firewall settings. This includes tools like 'arp', 'ifconfig', 'netstat', 'networksetup', and 'socketfilterfw', as well as 'defaults' when querying specific firewall preferences.
Detects enumeration of local network configuration
This rule detects attempts to modify file time attributes using the 'touch' command on macOS. Adversaries may alter file timestamps to hide new or modified files, making them appear less suspicious to forensic investigators or automated tools. The rule specifically looks for the execution of the 'touch' command with common arguments used for timestomping, such as '-t' (specify time), '-acmr' (change access, modification, creation, and reference times), '-d' (specify date string), or '-r' (reference file).
Detects the creation of hidden user accounts on macOS. This can occur either by assigning a UserID less than 500 or by explicitly setting the 'IsHidden' option to true during account creation using the 'dscl' command-line utility.
This rule detects attempts to disable security tools on macOS systems. It specifically looks for the use of '/bin/launchctl' to 'unload' security-related plists (property list files) associated with common security software like Objective-See's LuLu and BlockBlock, Google Santa, Carbon Black, Little Snitch, Tenable Nessus, OpenDNS Umbrella, Crowdstrike Falcon, osquery, Filebeat, Auditbeat, Packetbeat, and td-agent. Additionally, it detects attempts to disable macOS Gatekeeper using '/usr/sbin/spctl' with the 'disable' argument.
Detects attempts to clear macOS system logs by identifying common commands used for file deletion ('rm', 'unlink', 'shred') when targeting known log directories such as '/var/log' or user-specific '/Users/*/Library/Logs/'. This activity is often performed by adversaries to remove evidence of their presence and actions on a compromised system.
This rule detects attempts to bypass macOS Gatekeeper by removing the 'com.apple.quarantine' extended attribute from a file using the 'xattr' utility. This action prevents Gatekeeper from performing its security checks on the file, allowing untrusted applications to execute without user prompts.
Page 170 of 174