Sigma detection rules, expert-reviewed

Suspicious Persistence Load via Launchctl (via process_creation)

This rule detects launchctl loading or bootstrapping a job whose plist sits in a LaunchAgents or LaunchDaemons folder or a temp location, the activation step for launch-item persistence on macOS. Launchctl-driven persistence is a technique tracked in the Red Canary Threat Detection Report macOS coverage. Detecting the load surfaces a persistence mechanism being enabled.

Suspicious Kernel Extension Load on macOS (via process_creation)

This rule detects kextload, kextutil or kmutil loading a kernel extension, a technique that can install a persistent, high-privilege driver on macOS and is abused by rootkits and stalkerware. Kernel extension abuse is tracked in the Red Canary Threat Detection Report macOS coverage. Detecting the load surfaces kernel-level code being introduced.

AppleScript do-shell-script Abuse via Osascript (via process_creation)

This rule detects osascript running an AppleScript do-shell-script clause that also invokes curl, base64, python or a shell in temp, a pattern macOS malware and post-exploitation tooling use to stage and run second-stage code. AppleScript-driven shell execution is a scripting-abuse technique noted in the Red Canary Threat Detection Report macOS coverage. Detecting this combination surfaces script-based execution on macOS endpoints.

Untrusted Disabling of macOS Gatekeeper via Spctl (via process_creation)

This rule detects spctl --master-disable, which turns off Gatekeeper so unsigned and unnotarized applications can run without warning, a defense-evasion step preceding malware execution on macOS. Disabling Gatekeeper is a technique tracked in the Red Canary Threat Detection Report macOS coverage. Detecting this command surfaces an attacker removing code-signing enforcement.

Untrusted Disabling of macOS System Integrity Protection (via process_creation)

This rule detects csrutil disable, which turns off System Integrity Protection so an attacker can modify protected system locations and load unsigned kernel code on macOS. Disabling SIP is a defense-evasion technique tracked in the Red Canary Threat Detection Report macOS coverage. Detecting this command surfaces removal of a core macOS protection.

Malicious Disabling of macOS Automatic Software Updates via Defaults

This rule detects use of the defaults command to turn off automatic macOS software update checks or downloads. The XCSSET v4.0 malware disables SoftwareUpdate AutomaticCheckEnabled and AutomaticDownload to keep the host on vulnerable software and preserve its foothold. Detecting this configuration change exposes defense evasion that weakens the system patch posture.

Suspicious macOS Hardware Identifier Reconnaissance via ioreg (via process_creation)

This rule detects execution of ioreg querying IOPlatformExpertDevice to harvest the hardware UUID as performed by trojanized text editor malware targeting Chinese users during victim fingerprinting which precedes second-stage payload delivery.

Suspicious macOS SSH Loopback Connection for TCC Bypass

This rule detects an SSH client connecting to the local loopback address on macOS. It maps to a technique where an attacker uses ssh to localhost so the spawned session inherits full disk access granted to the SSH daemon, bypassing the TCC privacy prompt. Detecting loopback SSH can surface abuse of remote services for privacy control evasion.

Suspicious Hidden Local Account Creation via Dscl (via process_creation)

This rule detects dscl creating a user record together with hidden-account or UID attributes, a persistence technique used to add a stealthy admin account that does not appear on the macOS login window. Hidden account creation is tracked in the Red Canary Threat Detection Report macOS coverage. Detecting this surfaces a covert local account being planted.

Suspicious AppleScript Payload Execution via osascript (macOS)

This rule detects osascript executing a compiled AppleScript (.scpt) file, matching AppleScript payload delivery observed in fake macOS application installers distributing infostealers. Adversaries use .scpt files dropped from mounted DMG images to run malicious logic and harvest credentials. AppleScript execution of on-disk .scpt files outside trusted automation workflows is unusual and warrants review.

Suspicious AppleScript Execution Spawning a Shell via Osascript

This rule detects osascript running an AppleScript that invokes do shell script to launch shell commands, a bridge XCSSET v4.0 uses to run in-memory modules and shell payloads on macOS. This pattern lets the malware execute code while presenting as ordinary automation. Detecting the AppleScript to shell bridge exposes scripted execution used to run the stealer components.

Masquerading Cuckoo Stealer LaunchAgent Masquerading as Homebrew Updater (via file_event)

This rule detects creation of a LaunchAgent plist named com.homebrew.brewupdater used by Cuckoo Stealer to persist on macOS after a fake Homebrew ClickFix lure. Adversaries leverage a Homebrew-themed LaunchAgent label so the stealer relaunches at login while appearing to be a legitimate package updater.

Suspicious Payload Execution From Private Temp Directory via Process Creation

This rule detects execution of a binary located under the macOS private temp directory, the staging path used in the HM Surf exploitation chain to run a downloaded second-stage payload. Adversaries drop tools into world-writable temp locations and execute them there to evade scrutiny before establishing persistence.

Suspicious Interpreter Spawned by launchd from Application Bundle

This rule detects the macOS launchd process directly spawning a shell or script interpreter that executes a payload located inside an application bundle Contents/MacOS path. This behavior corresponds to the CVE-2021-30657 Gatekeeper bypass where an app lacking an Info.plist is launched without notarization checks. It lets attackers run arbitrary code while evading Gatekeeper.

Suspicious osascript Execution of Encoded AppleScript on macOS (via process_creation)

This rule detects osascript invoking a shell command through AppleScript, a pattern Poseidon Stealer uses to run base64 and hex decoded payloads before terminating the Terminal window. The combination of osascript with an inline do shell script and a decoding utility indicates obfuscated execution rather than normal automation. This behavior stages the stealer while evading casual inspection.