Sigma detection rules, expert-reviewed

Malicious Fake Zoom AppleScript Execution via Osascript

This rule detects osascript executing the zoom_sdk_support AppleScript, an initial access lure used by BlueNoroff in the Web3 macOS intrusion analyzed by Huntress. The threat actor delivers a fake Zoom support script to trick targets into running malicious AppleScript that stages further payloads. Execution of this named script is a high-confidence indicator of the BlueNoroff social-engineering chain.

Malicious macOS LaunchAgent Persistence via Masqueraded com.apple hcpi Property List

This rule detects creation of a LaunchAgent property list that masquerades as an Apple system component using a com.apple prefix combined with an hcpi identifier. The MacSync RAT reverse engineered by Huntress installed persistence as a com.apple.<hex>.hcpi.plist LaunchAgent to survive reboots while blending in with legitimate Apple agents. The mismatch between the trusted-looking name and the user-writable LaunchAgents path is a strong persistence indicator.

Suspicious Keylogger Capture Database Written to macOS Temp Directory

This rule detects creation of google_cache.db under a macOS temp directory such as private tmp, the collection store used by the BlueNoroff keylogger and screen capture module analyzed by Huntress. The implant records keystrokes and screenshots into this disguised database before exfiltration. A capture database with a browser-cache-like name in a temp path is a strong collection indicator.

Malicious Telegram Update LaunchDaemon Persistence on macOS

This rule detects creation of a LaunchDaemon property list masquerading as a Telegram updater such as com.telegram2.update.agent.plist, a persistence mechanism used by BlueNoroff as analyzed by Huntress. Attackers install a LaunchDaemon with a trustworthy-sounding label to run their implant at boot. A LaunchDaemon impersonating a Telegram update service is a strong macOS persistence indicator.

Suspicious osascript Fake Password Prompt by ClickLock macOS Stealer (via process_creation)

This rule detects osascript displaying a dialog that requests a password with a hidden answer field, the social-engineering prompt ClickLock macOS stealer uses to trick victims into surrendering their account credentials. The fake dialog mimics a legitimate system password request. Detecting this AppleScript pattern exposes active credential phishing on macOS.

Malicious AppleScript Execution of curl-Fetched Shell Payload via osascript (via process_creation)

This rule detects the RustyAttr execution chain where a shell payload fetched with curl is run through osascript do shell script, a macOS technique used by Lazarus per Group-IB to launch remotely retrieved commands. Adversaries combine command substitution with AppleScript to execute downloaded scripts in memory, so this pattern surfaces hands-on payload execution.

Suspicious ClickLock LaunchAgent Persistence Plist Creation (via file_event)

This rule detects creation of the com.authirity or com.chromer LaunchAgent property lists that ClickLock macOS stealer drops for RunAtLoad persistence. The misspelled and lookalike labels masquerade as legitimate system or browser agents while ensuring the stealer relaunches. Detecting these plists exposes ClickLock persistence.

Suspicious macOS Login Keychain Access via Command Line

This rule detects command line access to the user login keychain database, which the Atomic (AMOS) Stealer copies to harvest stored credentials and secrets. Direct references to login.keychain-db from shell tooling are unusual outside of backup or security software and warrant investigation for credential theft.

Malicious macOS Keychain Credential Theft via security find-generic-password (via process_creation)

This rule detects abuse of the macOS security command to dump a Chrome keychain secret in plaintext using find-generic-password with the -ga flag. Poseidon Stealer runs this to extract the Chrome Safe Storage key so it can decrypt saved browser credentials. Scripted keychain access targeting browser entries is a reliable sign of credential theft on macOS.

Suspicious osascript LaunchAgent Plist Persistence for PhantomPulse on macOS

This rule detects osascript writing a LaunchAgent property list to establish persistence as used by the macOS PhantomPulse RAT variant in Elastic research. Using AppleScript to drop a plist under LaunchAgents lets the implant execute automatically at login while avoiding direct file tooling.

Suspicious osascript Spawning Shell Executing Hidden macOS Payload via Axios Compromise

This rule detects osascript dispatching a shell that executes a hidden payload located under Library Caches as observed in the macOS variant of the Axios supply chain RAT. Attackers use AppleScript to launch a persistent implant while evading command line inspection, marking early stage execution on developer endpoints.

Suspicious Dscl Authonly Password Validation via BANSHEE Credential Phishing

This rule detects the dscl directory service utility invoked against the local node with the authonly option which BANSHEE uses to validate a password harvested through an AppleScript phishing dialog. Adversaries confirm stolen macOS account credentials before using them for further access and keychain theft.

Suspicious System Profiler Hardware Reconnaissance via BANSHEE

This rule detects the system_profiler utility being run against hardware and software data types which the BANSHEE macOS infostealer uses to fingerprint the victim host model and environment. Adversaries collect this system information to profile targets and support later data exfiltration decisions.

Suspicious Execution of Hidden Binary from Private Tmp via Process Creation

This rule detects execution of a dot-prefixed hidden binary from the private tmp directory which the macOS pirate ship campaign uses to run its dropped Khepri payload from a concealed location. Running hidden executables out of a world-writable temporary directory is a strong indicator of malware attempting to evade file visibility.

Suspicious KANDYKORN Python Loader Execution via Process Creation

This rule detects execution of the Watcher and testSpeed Python scripts used in the DPRK KANDYKORN macOS intrusion to bootstrap the malware. These distinctively named loader scripts are run through the Python interpreter to fetch and stage later stages of the implant.