Every published rule

This rule detects the creation of a startup item plist file, that automatically get executed at boot initialization to establish persistence. Adversaries may use startup items automatically executed at boot initialization to establish persistence. Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items.

This rule detects use of system utilities (only grep for now) to discover security software discovery

This rule detects potential anomalous child processes of "jamf". Could be a sign of potential misuse of Jamf as a C2 server as seen by Typhon MythicAgent.

This rule detects anomalous child processes spawning from microsoft office suite applications such as word or excel. This could suggests hostile macro execution

This rule detects attempts to masquerade as legitimate files by adding a space to the end of the filename.

This rule detects the use of tail to extract bytes at an offset from an image and then decode the base64 value to create a new file with the decoded content. The detected execution is a bash one-liner.

This rule detects the execution of the hdiutil utility to mount disk images.

This rule detects additions to the Emond Launch Daemon that threat actors may use to gain persistence and elevate privileges.

This rule detects the execution of "system_profiler" with specific "Data Types" that have been seen being used by threat actors and malware. It provides system hardware and software configuration information. This process is primarily used for system information discovery. However, "system_profiler" can also be used to determine if virtualization software is being run for defense evasion purposes.