Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
215 rules
macOS hdiutil Disk Image Creation via Process Execution
Flags macOS executions of hdiutil with the 'create' option, consistent with disk image creation.
Omar Khaled (@beacon_exe), Huntrule TeamMacosprocess_creationMedium182Free2024-08-10macOS Process Creation: nscurl File Download Arguments
Flags nscurl executions on macOS that include download-oriented command-line options, indicating potential remote file retrieval.
Daniel Cortez, Huntrule TeamMacosprocess_creationMedium253Free2024-06-04macOS: Time Machine Exclusion Added via tmutil addexclusion
Alerts on tmutil commands that add new Time Machine exclusions to skip backing up selected files.
Pratinav Chandra, Huntrule TeamMacosprocess_creationMedium191Free2024-05-29macOS: Disable Time Machine via tmutil
Flags macOS tmutil commands that include disabling Time Machine to stop automated backups.
Pratinav Chandra, Huntrule TeamMacosprocess_creationMedium399Free2024-05-29macOS tmutil Time Machine Backup Deletion Attempts
Flags tmutil executions with delete in the command line that attempt to remove Time Machine backups.
Pratinav Chandra, Huntrule TeamMacosprocess_creationMedium3910Free2024-05-29MacOS Sysctl Usage for System Discovery (hw., kern., machdep.)
Flags macOS sysctl commands querying hw., kern., or machdep. values for system discovery.
Pratinav Chandra, Huntrule TeamMacosprocess_creationMedium429Free2024-05-27macOS launchctl Execution of Launch Agent/Daemon
Flags launchctl usage on macOS to submit, load, or start Launch Agents/Daemons, a common persistence mechanism.
Pratinav Chandra, Huntrule TeamMacosprocess_creationMedium428Free2024-05-13macOS TeamViewer Remote Session Launch via TeamViewer_Service Command Line
Flags macOS executions of TeamViewer Desktop with the IPC/module command line when launched by the TeamViewer service.
Josh Nickels, Qi Nan, Huntrule TeamMacosprocess_creationLow214Free2024-03-11macOS Process Execution of system_profiler for System Discovery via Specific Data Types
Flags macOS system_profiler runs that request application, hardware, network, and USB data via command-line data types.
Stephen Lincoln `@slincoln_aiq` (AttackIQ), Huntrule TeamMacosprocess_creationMedium564Free2024-01-02macOS SIP Status Enumeration via csrutil status
Flags execution of "csrutil status" on macOS to enumerate System Integrity Protection state.
Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule TeamMacosprocess_creationLow132Free2024-01-02macOS csrutil Used to Disable System Integrity Protection (SIP)
Detects macOS processes running csrutil to disable SIP by matching /csrutil with a command line containing 'disable'.
Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule TeamMacosprocess_creationMedium181Free2024-01-02macOS Bash Pipelines Extract Image Bytes and Base64-Decode Output to a File
Alerts on bash on macOS that tails image bytes, base64-decodes them, and writes decoded output to a new file.
Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule TeamMacosprocess_creationHigh122Free2023-12-20macOS System Information Discovery via sw_vers with product/build flags
Detects sw_vers executions on macOS that request product name/version or build version details.
Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule TeamMacosprocess_creationMedium183Free2023-12-20macOS Process Discovery via ioreg I/O Kit Registry Queries
Flags macOS executions of ioreg with discovery-oriented arguments and device/vendor strings from command-line telemetry.
Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule TeamMacosprocess_creationMedium252Free2023-12-20macOS: In-Memory Download and Compile via curl and osacompile in a Single Command
Alerts when macOS processes include both curl and osacompile, consistent with downloading and compiling payloads.
Sohan G (D4rkCiph3r), Red Canary (idea), Huntrule TeamMacosprocess_creationMedium283Free2023-08-22