Sigma detection rules, expert-reviewed

Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.

ATT&CK coverage

Initial access
Execution
Persistence
Privilege escalation
Defense evasion
Credential access
Discovery
Lateral movement
Collection
Command and control
Exfiltration
Impact

153 rules

macOS Local Network Configuration Discovery via ARP/ifconfig/netstat/networksetup/defaults
Finds macOS network discovery activity by spotting arp/ifconfig/netstat/networksetup/socketfilterfw and specific firewall preference reads.
remotephone, oscd.community, Huntrule TeamMacosprocess_creationInformational271
Free2020-10-06
macOS Cron Task Abuse via crontab Executed from /tmp
Detects macOS cron scheduling activity where crontab is run with /tmp in the command line.
Alejandro Ortuno, oscd.community, Huntrule TeamMacosprocess_creationMedium486
Free2020-10-06
macOS Local User Account Creation via dscl or sysadminctl
Flags macOS commands (dscl create or sysadminctl addUser) that add local user accounts for persistence.
Alejandro Ortuno, oscd.community, Huntrule TeamMacosprocess_creationLow80
Free2020-10-06