Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
215 rules
macOS Process Creation: Suspicious find Usage for Permission/Setuid Discovery
Alerts on macOS executions of /find containing permission enumeration flags for setuid/setgid and writable/executable files.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamMacosprocess_creationMedium151Free2022-12-28macOS Script Editor Spawns Suspicious Command-Line Interpreters
Alerts when Script Editor launches command-line tools or interpreters like curl, shell binaries, python, or perl.
Tim Rauch (rule), Elastic (idea), Huntrule TeamMacosprocess_creationMedium172Free2022-10-21macOS XCSSET Execution Indicators via bash-launched curl, osacompile, plutil, or zip
Flags macOS process chains involving bash-driven curl plus osacompile/plutil/zip operations targeting user and Group Containers paths.
Tim Rauch (rule), Elastic (idea), Huntrule TeamMacosprocess_creationMedium582Free2022-10-17macOS Process Execution Traces Indicating WizardUpdate Downloader/C2 Staging
Flags macOS process creations showing curl+eval execution and intermediate agent indicators associated with WizardUpdate activity.
Tim Rauch (rule), Elastic (idea), Huntrule TeamMacosprocess_creationHigh273Free2022-10-17macOS: Built-in openssl used to base64-decode and decrypt payload from mounted DMG volume
Alerts on OpenSSL base64-decode/decrypt commands using DMG-mounted '/Volumes/' paths on macOS.
Tim Rauch (rule), Elastic (idea), Huntrule TeamMacosprocess_creationMedium537Free2022-10-17macOS: Process commands with trailing space in filename to evade matching
Alerts on macOS processes whose command line and image path end with a trailing space, a common filename masquerading trick.
remotephone, Huntrule TeamMacosprocess_creationLow122Free2021-11-20macOS firmwarepasswd Command-Line Manipulation
Alerts on firmwarepasswd usage on macOS indicating firmware password set, full, delete, or check actions.
Austin Songer @austinsonger, Huntrule TeamMacosprocess_creationMedium243Free2021-09-30macOS Emond Launch Daemon Rule Install Monitoring via plist and emondClients Paths
Alerts on macOS Emond rule plist or emond client database changes that may indicate persistence setup.
Alejandro Ortuno, oscd.community, Huntrule TeamMacosfile_eventMedium161Free2020-10-23macOS Remote System Discovery via arp or ping enumeration
Identifies macOS arp -a or ping to private/local IP ranges used for remote system enumeration.
Alejandro Ortuno, oscd.community, Huntrule TeamMacosprocess_creationInformational202Free2020-10-22macOS Process Network Service Scanning via nc or nmap/telnet
Flags macOS executions of nc/netcat, nmap, or telnet consistent with local or remote service enumeration.
Alejandro Ortuno, oscd.community, Huntrule TeamMacosprocess_creationLow152Free2020-10-21macOS AppleScript Execution via osascript with -e, .scpt, or .js
Flags osascript usage on macOS with -e and script indicators consistent with executing AppleScript.
Alejandro Ortuno, oscd.community, Huntrule TeamMacosprocess_creationMedium130Free2020-10-21macOS Gatekeeper bypass attempt using xattr to remove com.apple.quarantine
Flags macOS xattr usage that deletes the com.apple.quarantine extended attribute, consistent with a Gatekeeper bypass attempt.
Daniil Yugoslavskiy, oscd.community, Huntrule TeamMacosprocess_creationLow418Free2020-10-19macOS Shutdown/Reboot Command Execution via /shutdown, /reboot, or /halt Paths
Flags macOS process executions ending with shutdown, reboot, or halt indicating possible host power disruption.
Igor Fits, Mikhail Larin, oscd.community, Huntrule TeamMacosprocess_creationInformational245Free2020-10-19macOS System Network Connection Discovery via who, w, last, lsof, or netstat
Flags macOS process executions of who/w/last/lsof/netstat used to discover network or session information.
Daniil Yugoslavskiy, oscd.community, Huntrule TeamMacosprocess_creationInformational231Free2020-10-19macOS Security Software Discovery via grep of Known Security Software Names
Flags /usr/bin/grep on macOS when command lines include identifiers associated with security tools and agents.
Daniil Yugoslavskiy, oscd.community, Huntrule TeamMacosprocess_creationMedium386Free2020-10-19