Sigma detection rules, expert-reviewed

Suspicious TCC Privacy Database Reset via tccutil on macOS

This rule detects execution of tccutil reset which clears the macOS Transparency Consent and Control privacy permissions. The BlueNoroff GhostCall campaign manipulated the TCC database and reset permissions so its tooling could silently regain access to protected resources like the camera and screen recording. Resetting TCC is rarely done by normal users and is a strong signal of an attacker preparing to re-prompt or bypass privacy protections.

Suspicious macOS Gatekeeper Disable via spctl (via process_creation)

This rule detects use of spctl to disable Gatekeeper through the master-disable or global-disable options. Disabling Gatekeeper lets unsigned and unnotarized applications run without user prompts which attackers exploit to execute downloaded payloads. This system-wide policy change is rarely performed on managed endpoints.

Suspicious macOS SIP Disable via csrutil (via process_creation)

This rule detects execution of csrutil disable which turns off macOS System Integrity Protection. Attackers disable SIP to load unsigned kernel extensions and tamper with protected system locations. Because this normally requires recovery mode its appearance in live telemetry points to deliberate weakening of platform defenses.

Malicious Geacon Payload Download to Temp via Trojanized Editor (via process_creation)

This rule detects a command line downloading a payload to /tmp/updater from the transferusee C2 infrastructure used by trojanized text editor apps targeting Chinese users to deliver the Geacon backdoor which grants remote control and must be triaged as active compromise.

Suspicious Python Executing Script from var root Library Caches on macOS (via process_creation)

This rule detects a Python interpreter running a script located under /var/root/Library/Caches/ on macOS. The crypto-stealing backdoor stages its Python payload as /var/root/Library/Caches/<uuid>.py and executes it with elevated privileges, so this execution path indicates the hidden backdoor script running as root.

Suspicious AMOS Stealer Fake Password Prompt via osascript (via process_creation)

This rule detects osascript invoking a display dialog that requests a password with hidden input on macOS. The AMOS stealer shows a fake system password prompt through osascript to harvest the user credential before dumping keychain and wallet data, so this dialog pattern indicates credential phishing by the stealer.

Suspicious osascript Spawning Shell curl to External Host on macOS (via process_creation)

This rule detects osascript spawning a shell that runs curl on macOS. The BlueNoroff backdoor decrypts an embedded AppleScript that launches a shell and uses curl to reach its command-and-control server and pull further stages, so this parent-child chain indicates scripted download activity from a document-borne implant.

Suspicious macOS Backdoor LaunchAgent launched Plist Persistence (via file_event)

This rule detects creation of a LaunchAgent property list whose name begins with launched. in a LaunchAgents directory on macOS. The cracked-software crypto-stealing backdoor persists via /Library/LaunchAgents/launched.<uuid>.plist, so this naming prefix indicates the implant registering itself to run at login.

Suspicious Backgrounded Bash Payload via nohup On macOS

This rule detects a bash payload launched detached from the terminal with nohup and backgrounded, matching the persistence behavior observed in the ClickFix infostealer chain on macOS. The Odyssey and ACR stealers use this pattern so their downloaded script keeps running after the fake verification window is closed. Detaching execution helps the operator survive the user closing the shell they were tricked into using.

Suspicious macOS Keychain Credential Dumping via security find-generic-password

This rule detects use of the built-in security command line utility to extract stored secrets from the macOS Keychain with find-generic-password. The MacSync stealer analyzed by Huntress abused this technique to harvest saved credentials from compromised hosts. Because the security binary is legitimate, focus on unexpected parent processes and scripted invocations that indicate credential theft rather than administrator activity.

Suspicious osascript Spawning curl to High Port C2 via process_creation

This rule detects the macOS osascript interpreter spawning curl to reach an external host on port 8000. The axios supply chain payload used AppleScript to invoke curl against attacker infrastructure on this non-standard port, so this parent-child pattern indicates macOS command and control retrieval by the malicious package.

Suspicious Credential Archive Staging in tmp via process_creation

This rule detects archive or compression tooling on macOS creating output under the /tmp directory. The infostealer staged stolen browser and credential data into a hidden /tmp subfolder before compressing and exfiltrating it, so archive creation targeting /tmp is an indicator of local collection ahead of data theft.

Suspicious curl POST Exfiltration of Archive from tmp Staging Folder via process_creation

This rule detects curl invoked with an HTTP POST that uploads a file staged under the /tmp directory. A macOS infostealer collected stolen data into a /tmp staging folder and used curl to POST the resulting archive to its C2, so a curl POST referencing a /tmp file indicates active exfiltration of harvested data.

Suspicious macOS Credential Validation via dscl authonly

This rule detects the macOS dscl utility invoked with the authonly option to validate a user password, a credential verification technique used by the AMOS stealer to confirm harvested passwords before privilege escalation. Malware uses dscl authonly to test captured credentials without triggering a login prompt. Scripted authonly checks are atypical of normal user activity.

Malicious C2 Communication via cur1-request User-Agent on macOS

This rule detects a process command line containing the misspelled user-agent cur1-request, a distinctive command-and-control string used by BlueNoroff implants in the Web3 macOS intrusion analyzed by Huntress. The malware sets this hardcoded user-agent when beaconing to attacker infrastructure. Because the string is unique to this tooling, its presence is a high-confidence C2 indicator.