Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
215 rules
macOS Hidden User Creation via dscl (Hidden Account or UniqueID<500)
Detects dscl commands on macOS creating hidden users (UniqueID < 500 or IsHidden true).
Daniil Yugoslavskiy, oscd.community, Huntrule TeamMacosprocess_creationMedium182Free2020-10-10macOS Local System Account Enumeration via dscl, dscacheutil, and user listing commands
Detects macOS commands used to enumerate local system accounts via dscl, dscacheutil, id, lsof, who, and preference/query utilities.
Alejandro Ortuno, oscd.community, Huntrule TeamMacosprocess_creationLow112Free2020-10-08macOS Local Network Configuration Discovery via ARP/ifconfig/netstat/networksetup/defaults
Finds macOS network discovery activity by spotting arp/ifconfig/netstat/networksetup/socketfilterfw and specific firewall preference reads.
remotephone, oscd.community, Huntrule TeamMacosprocess_creationInformational341Free2020-10-06macOS Cron Task Abuse via crontab Executed from /tmp
Detects macOS cron scheduling activity where crontab is run with /tmp in the command line.
Alejandro Ortuno, oscd.community, Huntrule TeamMacosprocess_creationMedium536Free2020-10-06macOS Local User Account Creation via dscl or sysadminctl
Flags macOS commands (dscl create or sysadminctl addUser) that add local user accounts for persistence.
Alejandro Ortuno, oscd.community, Huntrule TeamMacosprocess_creationLow130Free2020-10-06