Sigma detection rules, expert-reviewed

Malicious Sapphire Sleet TCC Privacy Database Tampering via sqlite3 (via process_creation)

This rule detects sqlite3 being used to read or write the macOS TCC.db privacy database, an injection technique Sapphire Sleet uses to grant itself access to protected resources without user consent. Adversaries tamper with TCC.db to bypass macOS privacy controls covering the camera, microphone, and full disk access, so direct sqlite3 access to this database is a strong indicator of privacy-control subversion.

Malicious Sapphire Sleet curl to osascript Chain With mac-cur User-Agent (via process_creation)

This rule detects a curl download piped into osascript while using the distinctive mac-cur user-agent, the staged execution chain Sapphire Sleet uses after a fake software update to fetch and run AppleScript payloads on macOS. Adversaries use this pattern to pull second-stage code and execute it in memory, so the mac-cur marker combined with curl and osascript exposes the intrusion at the download-and-execute stage.

Malicious XCSSET LaunchDaemon Persistence Executing Hidden root Script

This rule detects a LaunchDaemon or shell invocation that runs a hidden dot-root script from the user home directory via bash. Microsoft observed XCSSET dropping a fake System Settings.app and a LaunchDaemon that executes ~/.root for persistence. A hidden script launched at daemon scope is atypical for legitimate software, so this pattern indicates the persistence mechanism.

Suspicious Base64 Decoding Piped to Shell on macOS

This rule detects base64 decoded output piped directly into a shell interpreter. Microsoft observed XCSSET decoding base64 and OpenSSL-encrypted stages and executing them inline. Piping decoded content straight to sh or bash hides the payload from static inspection, making it a strong obfuscated execution indicator on macOS.

Suspicious Hex Decoding Piped to Shell via xxd on macOS

This rule detects a shell command that reverses a hex dump with xxd and pipes the output directly into a shell interpreter. Microsoft observed the updated XCSSET malware using echo piped through xxd -p -r into sh to decode and run its payload. Decoding hex inline to execution is an obfuscation and defense-evasion pattern rarely seen in benign scripts.

Possible macOS TCC Bypass via mdimport Loading Custom Spotlight Importer

This rule detects the macOS mdimport utility run with recursive or explicit importer flags against a user Spotlight directory or a custom mdimporter bundle. Microsoft described this as the Sploitlight technique that abuses Spotlight importers to read TCC-protected data. Loading an attacker-supplied importer lets code harvest private files that Spotlight can reach, so this invocation indicates exploitation.

Suspicious Zsh Persistence via zshrc_aliases Appended to Shell Startup (via process_creation)

This rule detects references to a .zshrc_aliases file, the shell-profile persistence artifact that the updated XCSSET malware writes and sources from the user .zshrc to relaunch itself on each new terminal session. Adversaries hide persistence inside auxiliary zsh startup files to avoid altering the more commonly monitored .zshrc directly, so activity touching .zshrc_aliases is an indicator of shell-based persistence.

Malicious Encoded Payload Decoded and Piped to Shell via xxd or base64 (via process_creation)

This rule detects a hex or base64 encoded blob being decoded with xxd or base64 and piped directly into a shell, the obfuscated execution technique used by the updated XCSSET macOS malware to run its payloads. Adversaries encode commands to hide intent from static inspection and decode-and-run them in memory, so a decode utility feeding sh in one pipeline is a reliable indicator of obfuscated script execution.

Suspicious Replaced Filesystem Helper Execution from Library Filesystems Bundle (via process_creation)

This rule detects execution of newfs or fsck filesystem helper binaries from a third-party /Library/Filesystems bundle when not launched by the expected disk-management daemons, matching the replaced-binary technique used in the CVE-2024-44243 System Integrity Protection bypass. Adversaries swap these SIP-heritable helpers to gain code execution with protected privileges, so surfacing anomalous invocation exposes tampering before a malicious kernel extension is loaded.

Suspicious storagekitd Spawning Third-Party Filesystem Binary from Library Filesystems (via process_creation)

This rule detects the SIP-heritable daemon storagekitd spawning a third-party filesystem binary located under /Library/Filesystems, the core behavior of the macOS System Integrity Protection bypass tracked as CVE-2024-44243. Adversaries abuse storagekitd com.apple.rootless.install.heritable entitlement to run attacker-controlled newfs and fsck helpers with SIP-bypassing privileges, making early detection critical for stopping kernel extension loading and rootkit installation.

Malicious Sapphire Sleet LaunchDaemon Masquerading as Google WebKit Service (via file_event)

This rule detects creation of a LaunchDaemon property list named com.google.webkit.service.plist, a persistence artifact Sapphire Sleet plants on macOS while masquerading as a legitimate Google WebKit service. Adversaries install this daemon to survive reboots and maintain access after the initial lure compromise, so the appearance of this spoofed daemon name is a high-confidence sign of the implant.

Suspicious macOS ClickFix Execution Piping curl to zsh via UNC1069

This rule detects a shell command that downloads content with curl and pipes it directly into zsh as used by UNC1069 macOS ClickFix social engineering. Attackers execute remote script content in memory to install a WebSocket based backdoor without writing the stager to disk.

Suspicious macOS LaunchDaemon Masquerading as Apple System Updater

This rule detects creation of a LaunchDaemon named com.apple.system.updater.plist which impersonates an Apple system component as used by UNC1069 for macOS persistence. Attackers register this fake daemon so their payload in Library Caches or Library OSRecovery runs at boot.

Suspicious osascript Spawning Shell Interpreter on macOS

This rule detects osascript spawning a shell such as zsh or bash with an inline command, a chain used by the BlueNoroff GhostCall and GhostHire campaigns to bridge AppleScript into shell execution. Attackers use osascript to run AppleScript that then invokes /bin/zsh -c to execute follow-on commands and download stages. This AppleScript-to-shell handoff is a common macOS execution technique for staging payloads.

Suspicious Safari-Masquerading LaunchAgent Loaded via launchctl on macOS

This rule detects launchctl loading or unloading a LaunchAgent that masquerades as a Safari component such as com.applet.safari. The BlueNoroff GhostCall campaign installed persistence through fake Safari LaunchAgent plists and toggled them with launchctl. A LaunchAgent using an Apple-like label but not shipped by Apple indicates masqueraded persistence on macOS.