Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,647 detections
Filters
Last updated
All Time
Detection languages
1,768
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,502
1,169
782
528
521
Platforms
39,936
7,266
6,535
3,866
3,647
Products / Services
807
512
432
340
300
MITRE Techniques
1,180
582
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
This rule detects attempts to enumerate remote systems on a macOS host using the 'arp' and 'ping' utilities. Specifically, it looks for 'arp -a' commands, which list all current ARP entries, and 'ping' commands targeting common private IP address ranges (10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12) as well as localhost (127.0.0.0/8) and APIPA (169.254.0.0/16) ranges. This activity is indicative of an adversary performing network discovery to identify other systems for potential lateral movement.
This rule detects when the macOS Script Editor application spawns child processes that are commonly used for malicious activities. Specifically, it looks for the Script Editor launching shell interpreters (bash, sh, zsh, dash, fish), scripting languages (python, perl, php, osascript), or utilities often leveraged in attack chains (curl, mktemp, chmod, nohup, openssl, plutil, PlistBuddy, xattr, sqlite, funzip, popen). This behavior can indicate an adversary using AppleScript or other scripting capabilities within Script Editor to execute arbitrary commands, download payloads, or manipulate system configurations.
Detects potential OGNL Injection exploitation attempts in JVM-based applications, which could lead to Remote Code Execution (RCE). This rule specifically looks for error messages indicating OGNL parsing failures, such as 'org.apache.commons.ognl.OgnlException' or 'ExpressionSyntaxException', which are common indicators when an attacker attempts to inject malicious OGNL expressions. This type of vulnerability has been exploited in high-profile cases like Apache Struts (CVE-2017-5638) and Confluence (CVE-2022-26134).
Detects the use of the 'grep' utility on macOS to search for common security software names. This activity can indicate an adversary attempting to discover installed security solutions on a compromised system.
This rule detects command-line operations that interact with common shell history files on macOS systems. Adversaries often target these files (e.g., .bash_history, .zsh_history) to extract sensitive information such as credentials or commands executed by users, which can aid in further compromise or understanding the environment.
Detects the execution of 'osacompile' by potentially suspicious parent processes such as 'applet' or 'osascript'. This activity can indicate an attempt to compile AppleScript or JavaScript for Automation (JXA) code, which adversaries might use for execution or obfuscation.
Detects the usage of the 'find' command on macOS with specific permission-related arguments. These arguments are often used by attackers during discovery phases to locate files with unusual permissions, such as SUID/SGID binaries or world-writable files, which could indicate potential privilege escalation vectors or misconfigurations.
Detects attempts to extract credentials from macOS Keychain using the 'security' command-line utility. This rule specifically looks for the use of 'security' with arguments like 'find-certificate', 'export', 'dump-keychain', or 'login-keychain', which are commonly used to access or dump Keychain contents.
Detects the execution of suspicious child processes from macOS installer package parent processes. This includes various scripting interpreters like osascript, JXA, and common network utilities like curl and wget, which can be abused during preinstall or postinstall phases of a package installation.
Detects potential suspicious child processes of "jamf". This could indicate the abuse of Jamf as a C2 server, as observed with the Typhon MythicAgent. Specifically, the rule looks for '/bash' or '/sh' being spawned as child processes of the 'jamf' executable.
Detects the use of common network scanning tools like netcat, nmap, and telnet on macOS systems. The rule specifically looks for process creation events where the image path ends with '/nc', '/netcat', '/nmap', or '/telnet'. It includes a filter to exclude 'netcat' commands containing 'l' (often used for legitimate listening modes), aiming to reduce false positives related to simple network listening.
Detects the usage of tooling to sniff network traffic. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
Detects attempts to use the built-in 'screencapture' utility to collect screenshots on macOS systems. This utility can be used by adversaries to gather visual information from a compromised system.
Detects enumeration of local system groups on macOS using common command-line utilities such as `dscacheutil`, `cat`, and `dscl`. This activity is often performed by adversaries during the discovery phase to identify privileged accounts or groups for lateral movement or privilege escalation.
Detects when the built-in 'openssl' utility is used on macOS to decode and decrypt a payload, specifically when the command line arguments indicate base64 encoding and decryption, and the input file is located within a '/Volumes/' path. This behavior is often observed in adware or malware families like Bundlore and Shlayer, which use disk images (DMGs) to deliver encoded and encrypted payloads to evade detection and trick users into execution.
Detects the creation of scheduled tasks using the 'crontab' utility on macOS, specifically when the command line indicates the crontab job is being uploaded from the '/tmp/' directory. This behavior can be indicative of an adversary establishing persistence or executing malicious code.
This rule detects attempts to masquerade as legitimate files on macOS by appending a space to the end of a filename. This technique can trick users and the operating system into executing a malicious file, despite a seemingly benign file extension. The rule specifically looks for process creation events where the command line or the image path ends with a space character.
Detects the execution traces of the WizardUpdate malware, a macOS trojan that attempts to infiltrate macOS machines to steal data and is associated with other types of malicious payloads. The rule specifically looks for shell commands executing `curl` with a specific pattern (`=$(curl ` and `eval`) or `curl` commands containing `_intermediate_agent_`.
This rule detects attempts to collect data from the clipboard on macOS systems by executing the 'osascript' binary with arguments that indicate clipboard interaction. Specifically, it looks for command lines containing 'osascript', ' -e ', and 'clipboard'. This combination suggests an AppleScript or JavaScript for Automation (JXA) command being executed to access clipboard contents.
This rule detects the execution of 'osacompile' with the '-x' and '-e' flags, which indicates the compilation of a run-only AppleScript. Run-only AppleScripts are compiled scripts that cannot be easily decompiled or inspected, making them a potential method for adversaries to obfuscate malicious code and evade analysis. The '-x' flag compiles the script as execute-only, and '-e' specifies the script source.
Detects when the 'firmwarepasswd' utility is executed on macOS with commands to set, delete, or check the firmware password. This activity can indicate an attempt to manipulate the system's firmware security settings, potentially for malicious purposes such as preventing unauthorized OS installations or recovery, or to lock out legitimate users. The rule notes that this command is disabled on Apple Silicon-based Macs.
Page 171 of 174