Every published rule

This rule detects the execution of anomalous child processes from macOS installer package parent process. This includes osascript, JXA, curl and wget amongst other interpreters

This rule detects enumeration of local system groups

This rule detects potential persistence behavior using LaunchAgents or LaunchDaemons via the PlistBuddy utility

This rule detects the use of tooling to sniff network traffic. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.

This rule detects threat actors may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.

This rule detects use of system utilities to discover files and directories

This rule detects creation of a hidden user account on macOS (UserID < 500) or with IsHidden option

This rule detects attempts to create and add an account to the admin group via "sysadminctl"

This rule detects the use of "ioreg" which will show I/O Kit registry information. This process is used for system information discovery. It has been observed in-the-wild by calling this process directly or using bash and grep to look for specific strings.

This rule detects the execution of "sysctl" with specific arguments that have been used by threat actors and malware. It provides system hardware information. This process is primarily used to detect and avoid virtualization and analysis environments.

This rule detects potential execution of MeshAgent which is a tool used for remote access. Historical data shows that threat actors rename MeshAgent binary to evade detection. Matching command lines with the '--meshServiceName' argument can indicate that the MeshAgent is being used for remote access.

This rule detects the execution of the hdiutil utility to create a disk image.

This rule detects detection use of the command "split" to split files into parts and possible transfer.

This rule detects macOS Gatekeeper bypass via xattr utility

This rule detects disabling security tools

This rule detects execution of AppleScript of the macOS scripting language AppleScript.

This rule detects threat actors may use binary padding to add junk data and change the on-disk representation of malware. This rule detect using dd and truncate to add a junk data to file.

This rule detects anomalous child processes spawned from browsers. This could be a result of a potential web browser exploitation.

This rule detects the execution of a renamed instance of the Remote Monitoring and Management (RMM) tool, MeshAgent. RMM tools such as MeshAgent are frequently used by IT administrators for legitimate remote support and system management. However, hostile actors may exploit these tools by renaming them to bypass detection mechanisms, enabling unauthorized access and control over compromised systems.

This rule detects detecting attempts to extract passwords with grep and laZagne