Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
153 rules
macOS: Disable Security Tools via launchctl unload or spctl disable
Detects macOS attempts to impair security by unloading known security agent plists via launchctl or disabling Gatekeeper with spctl.
Daniil Yugoslavskiy, oscd.community, Huntrule TeamMacosprocess_creationMedium111Free2020-10-19macOS Keychain Credential Dump via security find-certificate/export and dump-keychain
Alerts on /usr/bin/security usage indicative of Keychain export/dump activity on macOS.
Tim Ismilyaev, oscd.community, Florian Roth (Nextron Systems), Huntrule TeamMacosprocess_creationMedium142Free2020-10-19macOS process using touch to modify file timestamps and hide file changes
Flags on macOS touch indicating file timestamp attribute changes for stealthy file activity.
Igor Fits, Mikhail Larin, oscd.community, Huntrule TeamMacosprocess_creationMedium253Free2020-10-19macOS Process Execution: dd and truncate used for binary padding
Flags macOS dd plus truncate command lines consistent with adding junk data for binary padding.
Igor Fits, Mikhail Larin, oscd.community, Huntrule TeamMacosprocess_creationHigh71Free2020-10-19macOS Base64 Utility Decoding Command Activity
Flags macOS base64 decoding by detecting /usr/bin/base64 runs with the -d argument.
Daniil Yugoslavskiy, oscd.community, Huntrule TeamMacosprocess_creationLow143Free2020-10-19macOS Process Creation: Command Line Access to Shell History Files
Flags macOS command lines referencing common shell history files, which may indicate credential access or cover-tracks behavior.
Mikhail Larin, oscd.community, Huntrule TeamMacosprocess_creationMedium113Free2020-10-17macOS split Command Used to Divide Files into Parts
Flags macOS process execution of split, indicating file splitting activity that may support staging or exfiltration.
Igor Fits, Mikhail Larin, oscd.community, Huntrule TeamMacosprocess_creationLow141Free2020-10-15macOS Network Sniffing Tool Execution via tcpdump or tshark
Identifies macOS execution of tcpdump or tshark, indicating potential network traffic sniffing activity.
Alejandro Ortuno, oscd.community, Huntrule TeamMacosprocess_creationInformational123Free2020-10-14macOS Startup Item Plist Created in StartupItems Folders
Alerts on creation of startup item .plist files in macOS StartupItems directories, potential boot persistence setup.
Alejandro Ortuno, oscd.community, Huntrule TeamMacosfile_eventLow306Free2020-10-14macOS Screen Capture via /usr/sbin/screencapture Process Execution
Identifies macOS instances where /usr/sbin/screencapture is executed to collect screenshots.
remotephone, oscd.community, Huntrule TeamMacosprocess_creationLow142Free2020-10-13macOS GUI Credential Prompt Capture via osascript
Flags osascript command lines that script system dialogs referencing authentication and password-related terms.
remotephone, oscd.community, Huntrule TeamMacosprocess_creationLow173Free2020-10-13macOS Local Group Enumeration via dscacheutil, cat /etc/group, or dscl
Flags macOS process executions that enumerate local system groups using dscacheutil, cat, or dscl commands.
Ömer Günal, Alejandro Ortuno, oscd.community, Huntrule TeamMacosprocess_creationInformational304Free2020-10-11macOS Host Indicator Removal via rm/unlink/shred of Local Log Paths
Flags macOS rm/unlink/shred commands targeting /var/log or ~/Library/Logs to remove local log evidence.
remotephone, oscd.community, Huntrule TeamMacosprocess_creationMedium2810Free2020-10-11macOS Hidden User Creation via dscl (Hidden Account or UniqueID<500)
Detects dscl commands on macOS creating hidden users (UniqueID < 500 or IsHidden true).
Daniil Yugoslavskiy, oscd.community, Huntrule TeamMacosprocess_creationMedium162Free2020-10-10macOS Local System Account Enumeration via dscl, dscacheutil, and user listing commands
Detects macOS commands used to enumerate local system accounts via dscl, dscacheutil, id, lsof, who, and preference/query utilities.
Alejandro Ortuno, oscd.community, Huntrule TeamMacosprocess_creationLow92Free2020-10-08