Every published rule

This rule detects the execution of programs as Launch Agents or Launch Daemons using launchctl on macOS.

This rule detects use of "find" binary in an anomalous manner to perform discovery

This rule detects file time attribute change to hide new or changes to existing files

This rule detects the execution of the nscurl utility to download files.

This rule detects the addition of a new file or path exclusion to MacOS Time Machine via the "tmutil" utility. An adversary could exclude a path from Time Machine backups to prevent certain files from being backed up.

This rule detects potential anomalous run-only executions compiled using OSACompile

This rule detects use of base64 utility to decode arbitrary base64-encoded text

This rule detects the use of "sw_vers" for system information discovery

This rule detects potential in-memory downloading and compiling of applets using curl and osacompile as seen used by XCSSET malware

This rule detects disabling of Time Machine (Apple's automated backup utility software) via the native macOS backup utility "tmutil". An adversary can use this to prevent backups from occurring.

This rule detects enumeration of local network configuration

This rule detects attempts to create and/or add an account to the admin group, thus granting admin privileges.

This rule detects commandline operations on shell history files

This rule detects enumeration of local or remote network services.

This rule detects deletion attempts of MacOS Time Machine backups via the native backup utility "tmutil". An adversary may perform this action before launching a ransonware attack to prevent the victim from restoring their files.

This rule detects the use of csrutil to disable the Configure System Integrity Protection (SIP). This method is used in post-exploit scenarios.

This rule detects passwords dumps from Keychain

This rule detects attempts to create and add an account to the admin group via "dscl"

This rule detects the execution traces of the XCSSET malware. XCSSET is a macOS trojan that primarily spreads via Xcode projects and maliciously modifies applications. Infected users are also vulnerable to having their credentials, accounts, and other vital data stolen.

This rule detects when a user manipulates with Firmward Password on MacOS. NOTE - this command has been disabled on silicon-based apple computers.