Sigma detection rules, expert-reviewed

Suspicious Remote Script Execution via curl Piped to bash with nohup on macOS (via process_creation)

This rule detects a shell command that pipes curl output into bash and detaches it with nohup, the initial execution used by a macOS ClickFix campaign to run an AppleScript stealer in the background after terminal closure. Fetching and executing a remote script in one detached command with no visible output is a strong indicator of ClickFix-style delivery on macOS.

Suspicious User Home Directory Modification via dscl Process Creation

This rule detects use of dscl to change a user account home directory, the core step of the macOS HM Surf technique that relocates the home path to tamper with Safari privacy preference files and bypass TCC protections. Modifying NFSHomeDirectory lets an attacker point sensitive Safari config to a controlled location and grant itself camera, microphone or location access.

Suspicious LaunchAgent Masquerading as coreaudiod (via file_event)

This rule detects creation of a LaunchAgent property list that masquerades as the legitimate coreaudiod system daemon inside a user LaunchAgents directory. The JINX-0164 actor dropped such plists to persist a macOS implant under a trusted-looking name. A user-writable LaunchAgent named after a core system daemon is a strong sign of persistence in a false context.

Suspicious Gatekeeper Quarantine Database Query via sqlite3

This rule detects sqlite3 querying the LSQuarantineEvents database, an anti-analysis check used by macOS Shlayer and Bundlore to inspect how a sample was downloaded and whether Gatekeeper flagged it. Reading this quarantine store helps the adware tailor its behavior and evade detonation environments.

Suspicious macOS Local Credential Validation via dscl authonly

This rule detects use of the Directory Service command line tool dscl with the authonly option to validate a local account password without producing a login session. The MacSync stealer described by Huntress used this technique to confirm harvested credentials and to brute force the local user password. Legitimate use is rare, so scripted or non-interactive invocations should be treated as credential-access activity.

Malicious Fake Homebrew Installer Execution via curl to Typosquatted Domain (via process_creation)

This rule detects a shell one-liner that curls an install script from the typosquatted homabrews domain and pipes it to bash, the ClickFix delivery behavior for Cuckoo Stealer on macOS. Adversaries leverage a fake Homebrew install command copied from a lure page to fetch and run the first-stage payload.

Suspicious macOS Download History Query via sqlite3

This rule detects sqlite3 querying the macOS LSQuarantine download history database. Silver Sparrow reads the quarantine events database to identify the URL it was downloaded from as part of its execution and environment checks. Command-line sqlite3 access to the LSQuarantine store is unusual and can indicate malware inspecting its own delivery.

Malicious ClickFix Stager Piping curl Output to osascript

This rule detects a curl download whose output is piped into osascript, the ClickFix execution pattern that tricks macOS users into running a remote AppleScript stager. Tech-support impersonation lures instruct victims to paste a one-liner that fetches and runs the loader delivering a macOS infostealer. Fetch-and-execute of remote script through osascript is not legitimate user behavior and indicates initial compromise.

Suspicious Shell Execution Referencing Mounted DMG Volume via Terminal (macOS)

This rule detects a shell process launched by Terminal whose command line references a path under /Volumes, matching the drag-to-Terminal execution technique used by fake macOS installers to run infostealer payloads. Adversaries populate the Terminal prompt with a path to a mounted DMG so the victim executes the payload manually. This bypasses Gatekeeper prompts and leads to credential and browser data theft.

Malicious Keychain Credential Extraction via security Utility

This rule detects the macOS security utility being used to dump keychain contents or extract stored passwords, a credential theft step performed by MacStealer after harvesting the login password. Reading generic and internet passwords from the keychain lets the malware collect browser and application secrets for exfiltration.

Suspicious LaunchAgent or LaunchDaemon Load via launchctl

This rule detects launchctl loading a property list from a LaunchAgents or LaunchDaemons directory, the persistence mechanism most macOS malware uses to survive reboots. Registering a malicious plist ensures the payload is relaunched automatically by launchd under user or system context.

Suspicious osascript to zsh Executing Hidden Payload via Axios Compromise

This rule detects osascript launching zsh with an inline command that runs a hidden binary under Library Caches as documented in Elastic detections for the Axios supply chain compromise. The AppleScript to shell handoff to a caches resident payload marks macOS implant execution on infected developer systems.

Suspicious Osascript Muting System Volume via BANSHEE Infostealer

This rule detects osascript executing an AppleScript command that mutes the system output volume which is an anti-analysis behavior performed by the BANSHEE macOS infostealer to hide audible feedback during execution. Adversaries silence the host so credential and data theft proceed without alerting the user.

Malicious Unsigned libConfigurer64 Dylib Side-Loading via Image Load

This rule detects loading of the libConfigurer64 dylib which pirated macOS applications side-load to execute the bundled Khepri implant. This uniquely named unsigned library is the loading mechanism of the campaign so its appearance indicates a trojanized pirated app running malicious code.

Malicious macOS LaunchDaemon Persistence Masquerading as Finder Helper

This rule detects creation of a LaunchDaemon property list named com.finder.helper.plist, the persistence artifact dropped by the AMOS stealer masquerading as a legitimate Finder helper. Registering this plist establishes root-level persistence that survives reboots. The fake Finder helper label is a known AMOS masquerade and is not a genuine Apple daemon.