Sigma detection rules, expert-reviewed

Suspicious COOKIE SPIDER LaunchDaemon Persistence via com.finder.helper Property List (via file_event)

This rule detects creation of the com.finder.helper property list used for persistence on macOS. The SHAMOS stealer writes this plist into the LaunchDaemons directory so the payload re-executes across reboots. This masqueraded property list name is a specific persistence indicator.

Suspicious Bad Apples Reverse Shell via socat pty

This rule detects socat invoked with a pseudo-terminal and stderr redirection, matching the Bad Apples use of socat to establish interactive reverse shells on macOS hosts. Allocating a pty through socat gives an operator a fully interactive remote shell over an attacker-controlled channel. Such socat invocations are uncommon on endpoints and indicate hands-on-keyboard access.

Malicious Bad Apples Remote Apple Events Lateral Movement via osascript

This rule detects osascript invoking an eppc URL, matching the Bad Apples technique that weaponizes Remote Apple Events over TCP 3031 for lateral movement across macOS hosts. Sending AppleScript to a remote host via the eppc scheme lets an operator execute code on another Mac using native primitives. Such cross-host osascript activity is rarely benign and indicates hands-on movement.

Suspicious Axios NPM macOS Persistence Masquerading as Apple Service

This rule detects references to the launchd label com.apple.act.mond spawned through zsh, matching the macOS payload of the Axios NPM supply chain incident. The malware masquerades its persistence agent as a legitimate Apple system service name to blend into launchd inventories. A non-Apple process registering or invoking this fabricated com.apple label indicates supply chain compromise.

Suspicious System Profiler Hardware Enumeration (via process_creation)

This rule detects system_profiler querying SPHardwareDataType which the Cosmic Leopard macOS implant uses to fingerprint the host and detect virtual or analysis environments. Hardware enumeration is an early discovery step that informs targeting and sandbox evasion decisions.

Suspicious Osascript Requesting Administrator Privileges (via process_creation)

This rule detects osascript invoking do shell script with administrator privileges which the Cosmic Leopard macOS malware uses to prompt the victim for credentials and escalate to root. Abusing AppleScript to request an authentication dialog is a common macOS privilege escalation and social engineering technique.

Suspicious TCC AppleEvents Reset via tccutil

This rule detects tccutil resetting AppleEvents privacy permissions, an automation abuse step performed by the Banshee macOS stealer. Clearing these permissions lets the malware re prompt and gain scripting control over other applications. Detecting it exposes the stealer manipulating privacy controls.

Suspicious Local Password Validation via dscl authonly

This rule detects dscl used with authonly to validate a local account password, the step Banshee performs to verify credentials captured through its fake prompt. This directory service call confirms a phished password before further theft. Detecting it surfaces credential validation by the stealer.

Malicious Shell Payload Piped from curl to zsh

This rule detects a base64 decoded command that pipes remote content fetched with curl directly into the zsh interpreter. This fileless macOS execution technique is used by fake software advertisement campaigns to run a stealer without touching disk.

LaunchAgent or LaunchDaemon Persistence File Creation on macOS (via file_event)

This rule detects creation of a property list in a LaunchAgents or LaunchDaemons directory, the primary autostart persistence mechanism on macOS that adversaries and stealers abuse to survive reboots and re-launch their payload. macOS persistence via launch items appears in the Red Canary Threat Detection Report. Detecting new launch-item plists surfaces persistence as it is installed, particularly outside of normal software installs.

Suspicious Removal of the macOS Quarantine Attribute via Xattr (via process_creation)

This rule detects xattr being used to strip the com.apple.quarantine attribute from a file, which bypasses the Gatekeeper prompt so a downloaded binary launches without the trust warning. Quarantine-attribute removal is a defense-evasion technique in the Red Canary Threat Detection Report macOS coverage. Detecting it surfaces an attempt to silently run downloaded content.

Malicious Remote Script Piped to a Shell on macOS (via process_creation)

This rule detects a macOS command line that downloads remote content with curl and pipes it straight into a shell or osascript, the paste-and-run delivery behavior behind macOS stealers such as Atomic and Odyssey that trick users into running a one-liner in Terminal. macOS paste-and-run stealer campaigns are called out in the Red Canary Threat Detection Report. Detecting the download-and-execute pipe surfaces infostealer installation at the execution stage.

Uncommon macOS Keychain Credential Access via Security Utility (via process_creation)

This rule detects use of the built-in security utility to dump the keychain or extract stored generic and internet passwords, a credential-access behavior used by macOS stealers to harvest saved secrets. Credential theft from the keychain supports the infostealer activity documented in the Red Canary Threat Detection Report. Because interactive keychain dumping is uncommon, detecting these security-command patterns surfaces credential harvesting.

Suspicious Persistence Load via Launchctl (via process_creation)

This rule detects launchctl loading or bootstrapping a job whose plist sits in a LaunchAgents or LaunchDaemons folder or a temp location, the activation step for launch-item persistence on macOS. Launchctl-driven persistence is a technique tracked in the Red Canary Threat Detection Report macOS coverage. Detecting the load surfaces a persistence mechanism being enabled.

Suspicious Kernel Extension Load on macOS (via process_creation)

This rule detects kextload, kextutil or kmutil loading a kernel extension, a technique that can install a persistent, high-privilege driver on macOS and is abused by rootkits and stalkerware. Kernel extension abuse is tracked in the Red Canary Threat Detection Report macOS coverage. Detecting the load surfaces kernel-level code being introduced.