Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,647 detections
Filters
Last updated
All Time
Detection languages
1,768
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,502
1,169
782
528
521
Platforms
39,936
7,266
6,535
3,866
3,647
Products / Services
807
512
432
340
300
MITRE Techniques
1,180
582
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
This rule detects the creation of a property list (.plist) file within the `/Library/StartupItems/` or `/System/Library/StartupItems` directories on macOS. These directories are associated with a deprecated persistence mechanism where files placed within them are automatically executed at boot initialization. Adversaries can leverage this to establish persistence on a compromised system by ensuring their malicious code runs every time the system starts.
Detects attempts to extract credentials from files using the 'grep' command to search for the keyword 'password' or by executing the 'laZagne' credential dumping tool. This rule is specifically tailored for macOS environments.
Detects suspicious child processes spawning from Microsoft Office suite applications (Word, Excel, PowerPoint, OneNote) on macOS. This behavior often indicates malicious macro execution attempting to leverage scripting interpreters or command-line utilities for further compromise.
This rule detects the execution of 'osacompile' and 'curl' in the same command line. This combination is indicative of in-memory downloading and compiling of applets, a technique observed in the XCSSET malware. 'curl' is used to download content, and 'osacompile' is used to compile AppleScript or JavaScript for Automation (JXA) scripts, which can then be executed.
This rule detects DNS queries for specific domains associated with the WannaCry ransomware killswitch. The presence of these queries indicates a potential WannaCry infection attempting to resolve its killswitch domain. If the domain resolves, the ransomware may cease its encryption activities.
Detects additions or modifications to Emond Launch Daemon rule files or client directories, which adversaries may use to gain persistence and elevate privileges on macOS systems. This rule specifically looks for new or changed files in '/etc/emond.d/rules/' (plist files) or '/private/var/db/emondClients/'.
Detects enumeration of local system accounts on macOS using various command-line utilities such as 'dscl', 'dscacheutil', 'cat /etc/passwd', 'id', and 'lsof -u'. This activity is indicative of an adversary attempting to discover existing user accounts on a compromised system.
Detects the execution of system utilities commonly used on macOS to discover network connections and logged-in users. These utilities include 'who', 'w', 'last', 'lsof', and 'netstat'. Adversaries may use these commands during the discovery phase to understand the network environment and identify potential targets or communication paths.
This rule detects the use of 'dd' and 'truncate' utilities to add junk data to a file, a technique known as binary padding. Adversaries may use this method to alter the on-disk representation of malware, potentially bypassing security tools that have file size limitations or rely on hash-based detection.
This rule detects the execution of AppleScript or JavaScript for Automation (JXA) scripts on macOS systems. It specifically looks for the 'osascript' utility being used with command-line arguments that indicate direct script execution ('-e') or the execution of script files with '.scpt' (AppleScript) or '.js' (JavaScript/JXA) extensions. This activity can be indicative of an adversary using scripting interpreters for execution.
Detects the execution of the 'jamf' binary with specific commands that could be used by attackers for privilege escalation, bypassing security controls, or modifying system configurations. This includes creating user accounts, managing the JAMF framework, removing MDM profiles, resetting passwords, and setting computer names.
This rule detects the execution of system commands commonly used to shut down, reboot, or halt a macOS system. Adversaries may use these commands to disrupt system availability or aid in the destruction of systems.
This rule detects the execution of the 'split' command, which is commonly used to break large files into smaller, more manageable pieces. Adversaries may use this technique to circumvent data transfer size limits during exfiltration or to prepare data for transfer through channels with size restrictions. The detection focuses on the command line execution of the 'split' utility.
This rule detects various suspicious exceptions within Django web applications. These exceptions, such as 'SuspiciousOperation' and its subclasses (e.g., 'DisallowedHost', 'InvalidSessionKey', 'RequestDataTooBig'), as well as 'PermissionDenied', often indicate attempts to exploit vulnerabilities, bypass security controls, or engage in other malicious activities against the web application. Monitoring these exceptions can help identify potential attacks like web parameter tampering, session hijacking attempts, or unauthorized access attempts.
Detects suspicious child processes spawned from web browsers on macOS. This activity often indicates a potential web browser exploitation attempt, where an attacker leverages a browser vulnerability to execute arbitrary commands or scripts on the system. The rule specifically looks for common scripting and command-line interpreters being launched as child processes of various browsers, while filtering out known legitimate browser-related activities like updates or recovery scripts.
Detects the usage of the `base64` utility on macOS to decode arbitrary base64-encoded text. This activity can be indicative of an adversary deobfuscating malicious content, such as scripts or payloads, that were previously encoded to evade detection.
This rule identifies execution traces indicative of the XCSSET macOS malware. XCSSET is known to spread via Xcode projects and maliciously modify applications. The rule looks for specific command-line patterns involving 'curl' to suspicious URLs, 'osacompile' and 'plutil' interacting with user and group containers, and 'zip' archiving data from user and group containers. These activities suggest potential command and control communication, persistence mechanisms, and data staging/exfiltration by the malware.
Detects possible malicious execution of JavaScript for Automation (JXA) in-memory via the `osascript` utility on macOS. This rule specifically looks for command-line executions of `osascript` that include the `-e` flag (for executing a script string), the `eval` function, `NSData.dataWithContentsOfURL` (indicating potential remote content loading), and either explicitly specifies 'JavaScript' as the language or includes '.js' in the command line.
This rule detects common SQL exception types in Python applications as defined by PEP 249. These exceptions (DataError, IntegrityError, ProgrammingError, OperationalError) indicate issues during database operations, which could range from malformed queries to database connectivity problems or constraint violations. While often benign, repeated or unusual occurrences of these errors could signal application vulnerabilities being exploited (e.g., SQL injection attempts leading to syntax errors) or other malicious database interactions.
Detects the creation of a new local user account on macOS systems using either the 'dscl' or 'sysadminctl' commands. Such accounts may be used for persistence without requiring persistent remote access tools.
This rule detects the usage of common macOS command-line utilities for file and directory discovery. Specifically, it looks for executions of '/usr/bin/file' with a very long command line (potentially indicating wildcard usage), '/bin/ls' with the recursive flag '-R', and direct executions of '/usr/bin/find' and '/usr/bin/mdfind'. It also includes a generic detection for '/tree' which might be a custom or less common utility for directory listing.
Page 172 of 174