Sigma detection rules, expert-reviewed

Suspicious File Download to tmp and Quarantine Removal via curl and xattr

This rule detects a shell command that downloads a file into the tmp directory with curl, strips the macOS quarantine attribute with xattr, marks it executable and runs it. This chain is the macOS infection path from fake Claude Code advertisements delivering an AMOS style stealer.

Malicious macOS Payload Download and Execution via curl Piped to zsh

This rule detects a remote payload being downloaded with curl and immediately piped into the zsh or sh shell for execution on macOS. This loader behavior was used by the MacSync stealer and RAT documented by Huntress to fetch and run its second stage without touching disk. Piping downloaded content straight into an interpreter is a hallmark of fileless staging and warrants investigation.

Obfuscated Base64-Decoded Payload Piped to Shell via macOS ClickFix Terminal Lure (via process_creation)

This rule detects a terminal one-liner that base64-decodes an embedded payload and pipes it into a shell, the macOS ClickFix execution behavior tricking users into pasting commands into Terminal. Adversaries leverage inline base64 decoding to hide the downloader and run it without writing an obvious script to disk.

Malicious Lazarus RustyAttr Payload Retrieval via curl to Support Cloudstore C2 (via process_creation)

This rule detects the macOS curl download used by Lazarus RustyAttr activity to fetch a shell payload over an insecure -L -k connection from support.cloudstore.business or support.docsend.site as reported by Group-IB. Adversaries retrieve the second-stage script from this infrastructure before executing it through AppleScript, making this an early indicator of the intrusion.

Suspicious macOS Quarantine Attribute Removal via xattr (via process_creation)

This rule detects xattr removing the com.apple.quarantine attribute from a file. Stripping this attribute clears the download provenance that triggers Gatekeeper checks allowing a downloaded payload to launch without warning. Attackers use this to make internet-sourced binaries appear locally trusted.

Suspicious Shell Password Gathering Referencing System Preferences (via process_creation)

This rule detects a shell command line referencing both system preferences and password, the shell-based credential-gathering pattern Red Canary associated with Atomic Stealer on macOS. This wording is used to coax users into entering their password while impersonating a system settings prompt, so its appearance warrants review for credential theft.

Suspicious macOS Keychain Credential Dump via security Utility (via process_creation)

This rule detects the macOS security command being used to dump keychain contents with the dump-keychain switch and the decrypt flag. Attackers abuse this built-in utility to extract stored passwords and secrets from the user keychain. Requesting a decrypted dump of all keychain items is a hallmark of credential theft on macOS.

Suspicious macOS Trojan-Proxy LaunchAgent GoogleHelperUpdater Persistence (via file_event)

This rule detects creation of a LaunchAgent property list named GoogleHelperUpdater.plist. The macOS Trojan-Proxy bundled with cracked software installs this masquerading Google-branded LaunchAgent to persist and relay traffic through the victim host, so this plist name in a LaunchAgents directory indicates the proxy implant establishing persistence.

Malicious macOS LaunchAgent Persistence com.nvm.protocal.plist

This rule detects creation of a LaunchAgent property list named com.nvm.protocal.plist, the macOS persistence dropped by the Mastra npm supply chain compromise. The plist impersonates a Node version manager helper to relaunch the malicious payload at every user login.

Possible ExifTool CVE-2026-3102 Command Injection via Child Process Spawn (via process_creation)

This rule detects exiftool spawning setfile or a shell interpreter as a child process, the command injection sink exploited in CVE-2026-3102 when a crafted image reaches the SetMacOSTags system call. The injected command runs attacker controlled code on macOS during metadata processing. Detecting exiftool as the parent of these processes surfaces exploitation of the vulnerability.

Malicious SUGARLOADER Configuration Masquerading as Safari Cache via File Event

This rule detects creation of a com.apple.safari.ck file in the Library Caches directory which is the RC4 encrypted configuration written by the SUGARLOADER stage of the KANDYKORN intrusion. The filename masquerades as a legitimate Safari cache to hide malware configuration on macOS hosts.

ClickFix macOS Payload Retrieval via curl Insecure Flags Piped to Shell (via process_creation)

This rule detects the macOS ClickFix chain where curl downloads a payload with insecure combined flags and pipes it directly into a shell for execution. Adversaries leverage the kfsSL flag bundle to silently bypass TLS validation and follow redirects before running the fetched script, making the curl-piped-to-shell pattern a high-confidence execution indicator.

Suspicious Security Software Enumeration on macOS

This rule detects enumeration of macOS security tooling such as Little Snitch, a discovery step malware performs to detect network monitoring and endpoint defenses before proceeding. Identifying protective software lets the malware adjust behavior or avoid noisy network activity.

Suspicious Access to Chrome Login Data on macOS (via process_creation)

This rule detects command-line access to the Chrome Login Data SQLite database on macOS, where stealers extract saved browser credentials and session cookies. macOS infostealers copy or query this file to harvest stored passwords and authenticated web sessions for account takeover.

Suspicious Curl Output Piped To Bash On macOS via ClickFix

This rule detects a curl download whose output is piped directly into a bash shell on macOS, matching the ClickFix social-engineering chain that tricks users into pasting a terminal command. This technique is used to deliver the Odyssey and ACR infostealers after a fake Cloudflare human-verification prompt. Fetching and executing remote code in one step lets the operator run a payload with no file written to disk beforehand.