Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
215 rules
macOS: JAMF CLI (jamf) execution for account and MDM management
Flags macOS executions of the JAMF CLI with command-line actions tied to account, MDM, and framework changes.
Jay Pandit, Huntrule TeamMacosprocess_creationLow231Free2023-08-22macOS Jamf MDM Suspicious Child Process Execution
Alerts when jamf on macOS spawns bash or sh, which may indicate misuse for command execution.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamMacosprocess_creationMedium459Free2023-08-22macOS Root Account Enable Attempt via dsenableroot
Detects macOS attempts to enable the root account by running /dsenableroot.
Sohan G (D4rkCiph3r), Huntrule TeamMacosprocess_creationMedium506Free2023-08-22macOS dseditgroup Used to Add User to admin Group
Flags dseditgroup command lines that edit and add a user to the macOS admin group.
Sohan G (D4rkCiph3r), Huntrule TeamMacosprocess_creationMedium325Free2023-08-22Suspicious Child Processes Spawned by Browsers on macOS
Alerts on browser-launched child processes on macOS where the child is a shell or scripting/utility binary, excluding known benign browser scripts.
Sohan G (D4rkCiph3r), Huntrule TeamMacosprocess_creationMedium152Free2023-04-05macOS: Process execution of osacompile by applet/osascript child processes
Flags macOS applet or osascript processes launching command lines that contain osacompile.
Sohan G (D4rkCiph3r), Red Canary (Idea), Huntrule TeamMacosprocess_creationMedium145Free2023-04-03macOS sysadminctl Used to Add User to Admin Group
Alerts when sysadminctl is used with -addUser and -admin to add a user to the macOS admin group.
Sohan G (D4rkCiph3r), Huntrule TeamMacosprocess_creationMedium163Free2023-03-19macOS dscl Adds User to Admin Group via -append /Groups/admin GroupMembership
Flags dscl commands on macOS that append a user into the local admin group membership.
Sohan G (D4rkCiph3r), Huntrule TeamMacosprocess_creationMedium2110Free2023-03-19macOS: Guest account enabled via sysadminctl
Flags sysadminctl command lines that appear to activate the macOS guest account.
Sohan G (D4rkCiph3r), Huntrule TeamMacosprocess_creationLow443Free2023-02-18macOS Persistence Attempt Using PlistBuddy to Modify LaunchAgents/LaunchDaemons
Identifies PlistBuddy commands that enable RunAtLoad for LaunchAgents or LaunchDaemons persistence on macOS.
Sohan G (D4rkCiph3r), Huntrule TeamMacosprocess_creationHigh211Free2023-02-18macOS Installer Scripts Spawning Suspicious Interpreter Child Processes
Alerts when macOS installer scripts (preinstall/postinstall) spawn shell, scripting, osascript, curl, or wget processes.
Sohan G (D4rkCiph3r), Huntrule TeamMacosprocess_creationMedium152Free2023-02-18macOS OSACompile Run-Only Script Execution
Flags osacompile commands on macOS using run-only (-x) with inline script (-e) execution.
Sohan G (D4rkCiph3r), Huntrule TeamMacosprocess_creationHigh541Free2023-01-31macOS Office Apps Spawning Shell or Scripting Processes
Alerts when Microsoft Office on macOS launches suspicious shell/script or download utilities as child processes.
Sohan G (D4rkCiph3r), Huntrule TeamMacosprocess_creationHigh369Free2023-01-31macOS JXA In-Memory Execution via osascript JavaScript eval and NSData URL loading
Detects osascript-launched in-memory JXA JavaScript execution patterns using eval and URL-based data loading.
Sohan G (D4rkCiph3r), Huntrule TeamMacosprocess_creationHigh193Free2023-01-31macOS osascript Clipboard Access via AppleScript Commands
Alerts on osascript commands that reference the system clipboard, which may indicate collection or automation misuse on macOS.
Sohan G (D4rkCiph3r), Huntrule TeamMacosprocess_creationMedium282Free2023-01-31