Sigma detection rules, expert-reviewed

Suspicious NimDoor Exfiltration Staging Directory Creation via uplex Prefix (via file_event)

This rule detects NimDoor staging stolen browser and credential data into a temporary directory whose path begins with the uplex prefix under private var tmp. The directory holds harvested data before exfiltration over the C2 channel. This distinctive staging path is not produced by legitimate macOS software.

Malicious NimDoor Loader Persistence via Masqueraded Google Updater (via file_event)

This rule detects the NimDoor loader binary that DPRK actors dropped under Application Support while impersonating a Google updater, using a capital letter I in place of the lowercase l in the file name GoogIe LLC. The loader launches the CoreKitAgent trojan and installs a LaunchAgent for persistence. The homoglyph file name is a reliable indicator of this macOS implant.

Malicious BlueNoroff Zshenv Persistence Marker Creation via tmp Init File (via file_event)

This rule detects the marker file that BlueNoroff writes to signal successful installation of its novel Zshenv persistence during the Hidden Risk campaign. The malware abuses the shell configuration file that is sourced for every Zsh session and drops a hidden success marker under tmp. The marker file name is unique to this implant.

Malicious Data Exfiltration via curl with Stealer Specific BuildID Header

This rule detects curl invoked with the custom BuildID or buildid HTTP header used by the Atomic and Odyssey macOS information stealers to exfiltrate collected data to their command and control servers. These distinctive headers identify the stealer build during the collection upload. Detecting them surfaces active credential and data theft on macOS endpoints.

Suspicious osascript Password Prompt via AppleScript Display Dialog (via process_creation)

This rule detects osascript invoking an AppleScript display dialog that requests a password, the credential-harvesting behavior Red Canary tied to Atomic Stealer and related macOS malware. Legitimate applications rarely prompt for a password through scripted dialogs, so this combination indicates an attempt to socially engineer the user into revealing local credentials.

Malicious TCC AppleEvents Reset via Tccutil

This rule detects the tccutil command resetting the AppleEvents privacy permissions, which clears prior automation consent so the malware can re-prompt or re-establish control of other applications. XCSSET v4.0 resets AppleEvents to enable its AppleScript-driven automation. Detecting this reset surfaces manipulation of the macOS privacy framework for defense evasion.

Suspicious Base64 Bash Execution via nohup on macOS via ClickFix (via process_creation)

This rule detects a detached bash process decoding a Base64 payload via nohup on macOS, matching the Odyssey stealer delivery produced by the IUAM ClickFix Generator for Apple systems. The lure instructs victims to paste a terminal command that background-executes an obfuscated downloader. Detecting this pattern surfaces cross-platform ClickFix infections targeting macOS users.

Suspicious Access to macOS Login Keychain by Slow Pisces (via process_creation)

This rule detects command-line access to the macOS login.keychain-db file, which Slow Pisces targets to steal stored credentials alongside SSH keys during its developer-focused intrusions. Reading the login keychain exposes saved passwords and tokens for further account compromise.

Malicious curl Download From Fake Apple Ads Domain on macOS (via process_creation)

This rule detects curl retrieving payloads from the apple-ads-metric staging domain used to deliver npm and back.sh second-stage scripts in the macOS crypto-sector intrusion. Downloading follow-on tooling from this Apple-themed domain marks the ingress tool transfer stage of the attack.

Suspicious mdfind Search for Private Key Files on macOS (via process_creation)

This rule detects use of mdfind to enumerate .pem private key files across a macOS system, a discovery step used by the RustDoor and Koi Stealer campaign to locate credentials in files. Bulk searching for private keys precedes theft of SSH and certificate material for lateral movement and account access.

Malicious curl Exfiltration to Attacker Upload Endpoint on macOS (via process_creation)

This rule detects curl multipart form uploads to the /tasks/upload_file endpoint used by a North Korea-linked actor to exfiltrate stolen files from macOS crypto-sector targets. The RustDoor and Koi Stealer chain uploads harvested credentials and wallet data to attacker-controlled servers such as visualstudiomacupdate over this path.

Malicious macOS Stealer Staging to Users Shared Directory (via process_creation)

This rule detects processes referencing the /Users/Shared/NW staging directory used by the Cthulhu macOS stealer to collect harvested data before exfiltration. Use of this world-writable shared path for staging is a strong indicator of stealer activity preparing collected browser and wallet data.

Suspicious Remote Apple Events Enablement via systemsetup

This rule detects enabling of Remote Apple Events on macOS via systemsetup. This behavior matches in-the-wild macOS lateral movement where attackers turn on the eppc service to send AppleScript commands to remote hosts over the network. Enabling Remote Apple Events is rare in managed environments and provides attackers a native channel for remote code execution.

Malicious XCSSET Payload Drop to Temp and Hidden Home Paths

This rule detects creation of the specific staging artifacts used by XCSSET v4.0 including the tmp p.app bundle the tmp r file and the hidden tr file in the user home directory. These fixed drop paths hold the malware components and persistence loaders. Detecting these file writes provides a strong campaign-specific indicator of an XCSSET infection.

Suspicious __init__.py Drop in Public Directory by Slow Pisces (via file_event)

This rule detects creation of an __init__.py file inside the user Public directory, the drop location used by Slow Pisces to stage its RN Loader Python payload during fake coding-challenge lures. Planting a Python package init file in this path enables execution of the malicious loader when the developer runs the challenge code.