Every published rule

This rule detects the execution traces of the WizardUpdate malware. WizardUpdate is a macOS trojan that attempts to infiltrate macOS machines to steal data and it is linked with other types of hostile payloads, increasing the chances of multiple infections on a device.

This rule detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.

This rule detects attempts to use system dialog prompts to capture user credentials

This rule detects enumeration of local system accounts on MacOS systems. This can be used by adversaries to identify accounts for lateral movement or privilege escalation.

This rule detects access to clipboard content via osascript, which may be used for data collection but also occurs in legitimate clipboard utilities and automation scripts

This rule detects use of system utilities to discover system network connections

This rule detects attempts to enable the guest account using the sysadminctl utility

This rule detects when the macOS Script Editor utility spawns an unusual child process.

This rule detects the enumeration of other remote systems.

This rule detects the execution of the "chflags" utility with the "hidden" flag, to hide files on MacOS. When a file or directory has this hidden flag set, it becomes invisible to the default file listing commands and in graphical file browsers.

This rule detects the use of csrutil to view the Configure System Integrity Protection (SIP) status. This method is used in post-exploit scenarios.

This rule detects possible hostile execution of JXA in-memory via OSAScript

This rule detects attempts to enable the root account via "dsenableroot"

This rule detects attempts to use screencapture to collect macOS screenshots

This rule detects when a built-in utility is leveraged to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into running hostile code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.

This rule detects execution of the "jamf" binary to create user accounts and run commands. For example, the binary can be misused by adversaries on the system to bypass security controls or remove application control polices.

This rule detects potential anomalous applet or osascript running "osacompile".

This rule detects misuse of the cron utility to perform task scheduling for initial or recurring execution of hostile code. Detection will focus on crontab jobs uploaded from the tmp folder.

This rule detects deletion of local audit logs

This rule detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.