Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
215 rules
macOS Process Creation: grep 'password' or laZagne Credential Extraction
Detects macOS executions of grep targeting 'password' strings and laZagne, suggesting local credential extraction attempts.
Igor Fits, Mikhail Larin, oscd.community, Huntrule TeamMacosprocess_creationHigh131Free2020-10-19macOS File and Directory Discovery via System Utilities
Detects macOS usage of file, ls -R, find, mdfind, or tree for file/directory enumeration.
Daniil Yugoslavskiy, oscd.community, Huntrule TeamMacosprocess_creationInformational253Free2020-10-19macOS: Disable Security Tools via launchctl unload or spctl disable
Detects macOS attempts to impair security by unloading known security agent plists via launchctl or disabling Gatekeeper with spctl.
Daniil Yugoslavskiy, oscd.community, Huntrule TeamMacosprocess_creationMedium161Free2020-10-19macOS Keychain Credential Dump via security find-certificate/export and dump-keychain
Alerts on /usr/bin/security usage indicative of Keychain export/dump activity on macOS.
Tim Ismilyaev, oscd.community, Florian Roth (Nextron Systems), Huntrule TeamMacosprocess_creationMedium162Free2020-10-19macOS process using touch to modify file timestamps and hide file changes
Flags on macOS touch indicating file timestamp attribute changes for stealthy file activity.
Igor Fits, Mikhail Larin, oscd.community, Huntrule TeamMacosprocess_creationMedium293Free2020-10-19macOS Process Execution: dd and truncate used for binary padding
Flags macOS dd plus truncate command lines consistent with adding junk data for binary padding.
Igor Fits, Mikhail Larin, oscd.community, Huntrule TeamMacosprocess_creationHigh181Free2020-10-19macOS Base64 Utility Decoding Command Activity
Flags macOS base64 decoding by detecting /usr/bin/base64 runs with the -d argument.
Daniil Yugoslavskiy, oscd.community, Huntrule TeamMacosprocess_creationLow283Free2020-10-19macOS Process Creation: Command Line Access to Shell History Files
Flags macOS command lines referencing common shell history files, which may indicate credential access or cover-tracks behavior.
Mikhail Larin, oscd.community, Huntrule TeamMacosprocess_creationMedium213Free2020-10-17macOS split Command Used to Divide Files into Parts
Flags macOS process execution of split, indicating file splitting activity that may support staging or exfiltration.
Igor Fits, Mikhail Larin, oscd.community, Huntrule TeamMacosprocess_creationLow161Free2020-10-15macOS Network Sniffing Tool Execution via tcpdump or tshark
Identifies macOS execution of tcpdump or tshark, indicating potential network traffic sniffing activity.
Alejandro Ortuno, oscd.community, Huntrule TeamMacosprocess_creationInformational153Free2020-10-14macOS Startup Item Plist Created in StartupItems Folders
Alerts on creation of startup item .plist files in macOS StartupItems directories, potential boot persistence setup.
Alejandro Ortuno, oscd.community, Huntrule TeamMacosfile_eventLow346Free2020-10-14macOS Screen Capture via /usr/sbin/screencapture Process Execution
Identifies macOS instances where /usr/sbin/screencapture is executed to collect screenshots.
remotephone, oscd.community, Huntrule TeamMacosprocess_creationLow192Free2020-10-13macOS GUI Credential Prompt Capture via osascript
Flags osascript command lines that script system dialogs referencing authentication and password-related terms.
remotephone, oscd.community, Huntrule TeamMacosprocess_creationLow313Free2020-10-13macOS Local Group Enumeration via dscacheutil, cat /etc/group, or dscl
Flags macOS process executions that enumerate local system groups using dscacheutil, cat, or dscl commands.
Ömer Günal, Alejandro Ortuno, oscd.community, Huntrule TeamMacosprocess_creationInformational344Free2020-10-11macOS Host Indicator Removal via rm/unlink/shred of Local Log Paths
Flags macOS rm/unlink/shred commands targeting /var/log or ~/Library/Logs to remove local log evidence.
remotephone, oscd.community, Huntrule TeamMacosprocess_creationMedium3610Free2020-10-11