Sigma detection rules, expert-reviewed

Suspicious Bad Apples File Transfer Server via tftpd

This rule detects tftpd launched with the write-enabled flag, matching the Bad Apples abuse of the native TFTP daemon on UDP 69 to stage and move payloads onto macOS hosts. Enabling writes on an ad hoc TFTP server turns a benign utility into an ingress channel for tooling. A user or service starting a writable tftpd is unusual and warrants review.

Suspicious LaunchDaemon Load via launchctl

This rule detects loading and enabling of a launchd job via launchctl with the -w flag. This behavior matches macOS lateral movement and persistence tradecraft where attackers install malicious plist based services to maintain access. While used by legitimate administration, unexpected launchctl load activity on endpoints can indicate persistence installation and should be reviewed.

Malicious Keychain Credential Theft via security find-generic-password by ClickLock macOS Stealer (via process_creation)

This rule detects the macOS security utility invoked with find-generic-password to dump the Chrome keychain secret, the exact command ClickLock stealer runs to extract stored browser credentials. Reading the keychain password non-interactively reveals credential theft. Detecting it exposes ClickLock harvesting saved secrets.

Suspicious BlueNoroff Hidden Payload Drop in Users Shared (via file_event)

This rule detects creation of the hidden files .pw or .pld under /Users/Shared/ on macOS. The BlueNoroff EdoneViewer dropper writes these hidden staging files to the world-readable Shared folder before executing its next stage, so their appearance indicates the backdoor unpacking its payload.

Suspicious macOS LaunchAgent or LaunchDaemon Plist Creation

This rule detects creation of a property list file inside the macOS LaunchAgents or LaunchDaemons directories. It maps to persistence where an attacker drops a launchd job configured with RunAtLoad and a short StartInterval to repeatedly execute a hidden payload from a temp path. Detecting new plists in these directories surfaces launchd persistence installation.

Malicious macOS Credential Verification via dscl authonly

This rule detects use of dscl with the authonly flag to validate a captured password against the local directory service, a technique used by the AMOS stealer to confirm harvested credentials after phishing the user. Legitimate interactive use of dscl authonly is rare. This behavior indicates active credential access and verification on the host.

Suspicious macOS Quarantine Bypass via xattr and chmod After curl Download

This rule detects a shell one liner that downloads a payload with curl then strips the com.apple.quarantine attribute and makes it executable as used by UNC5142 macOS ClickFix delivery. This behavior bypasses Gatekeeper so downloaded malware can run without user prompts.

Suspicious macOS Data Staging via ditto to Temp Archive in Attacker Directory (via process_creation)

This rule detects the ditto utility archiving collected data into a temp out.zip or writing into the attacker working directory used by the macOS ClickFix AppleScript stealer. Adversaries leverage ditto to bundle browser and wallet data for exfiltration to their C2 server.

Suspicious macOS Installer Invocation Spawned via Zoom Opener Helper (via process_creation)

This rule detects the macOS installer utility being launched with package and target arguments from a Zoom helper context. This maps to the ZoomOpener local webserver drive-by chain where a crafted launch request triggers installation of an attacker-supplied package. An attacker abuses this to silently install malicious software leading to remote code execution.

Suspicious AppleScript Execution via osascript Inline Command

This rule detects osascript invoked with an inline -e command on macOS, the AppleScript execution technique used by the AMOS stealer to display fake password prompts and drive credential theft. While osascript has legitimate administrative uses, inline execution from unexpected parents is a common stealer behavior. This should be reviewed alongside process lineage and subsequent credential access.

Suspicious macOS Persistence via launchctl submit (via process_creation)

This rule detects use of the legacy launchctl submit subcommand to register a background job for persistence. The JINX-0164 threat actor abused this mechanism to launch an implant under a masqueraded job label such as chrome.job. This technique lets attackers run code on login while blending in with legitimate agent labels.

Suspicious macOS Privilege Escalation Piping Password to sudo

This rule detects a stored password being piped into sudo with the stdin flag, the non-interactive privilege escalation used by the AMOS stealer after harvesting a user password. Reading a captured password from a hidden file and feeding it to sudo grants root without a prompt. This scripted sudo pattern is characteristic of macOS stealer malware.

Malicious AMOS Stealer AppleScript Execution via osascript

This rule detects osascript executing AppleScript that shells out to remove quarantine attributes and grant execution permissions, a technique used by the Atomic (AMOS) Stealer delivered through fake DeepSeek installer sites. Attackers combine do shell script with xattr and chmod to run unsigned payloads while evading Gatekeeper, so this activity is a strong indicator of macOS stealer staging.

Malicious Bad Apples Data Exfiltration via snmptrap OID

This rule detects snmptrap sending data to the attacker-specific enterprise OID 1.3.6.1.4.1.99999, matching the Bad Apples abuse of native macOS SNMP tooling to smuggle collected data out over an alternate protocol. Encoding stolen information inside SNMP trap fields evades controls focused on HTTP and DNS exfiltration. Use of this fabricated OID with snmptrap indicates covert exfiltration.

Suspicious Remote Script Downloaded via curl and Piped to Shell (via process_creation)

This rule detects a curl download piped directly into a shell in a single command line, the download-and-execute pattern used by the updated XCSSET malware to retrieve and run stage payloads from attacker infrastructure. Adversaries chain curl into sh to fetch and execute code without writing a script to disk, so this one-liner is a strong indicator of remote payload execution on macOS.