Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
153 rules
macOS: Time Machine Exclusion Added via tmutil addexclusion
Alerts on tmutil commands that add new Time Machine exclusions to skip backing up selected files.
Pratinav Chandra, Huntrule TeamMacosprocess_creationMedium131Free2024-05-29macOS: Disable Time Machine via tmutil
Flags macOS tmutil commands that include disabling Time Machine to stop automated backups.
Pratinav Chandra, Huntrule TeamMacosprocess_creationMedium339Free2024-05-29macOS tmutil Time Machine Backup Deletion Attempts
Flags tmutil executions with delete in the command line that attempt to remove Time Machine backups.
Pratinav Chandra, Huntrule TeamMacosprocess_creationMedium3310Free2024-05-29MacOS Sysctl Usage for System Discovery (hw., kern., machdep.)
Flags macOS sysctl commands querying hw., kern., or machdep. values for system discovery.
Pratinav Chandra, Huntrule TeamMacosprocess_creationMedium329Free2024-05-27macOS launchctl Execution of Launch Agent/Daemon
Flags launchctl usage on macOS to submit, load, or start Launch Agents/Daemons, a common persistence mechanism.
Pratinav Chandra, Huntrule TeamMacosprocess_creationMedium328Free2024-05-13macOS TeamViewer Remote Session Launch via TeamViewer_Service Command Line
Flags macOS executions of TeamViewer Desktop with the IPC/module command line when launched by the TeamViewer service.
Josh Nickels, Qi Nan, Huntrule TeamMacosprocess_creationLow174Free2024-03-11macOS Process Execution of system_profiler for System Discovery via Specific Data Types
Flags macOS system_profiler runs that request application, hardware, network, and USB data via command-line data types.
Stephen Lincoln `@slincoln_aiq` (AttackIQ), Huntrule TeamMacosprocess_creationMedium444Free2024-01-02macOS SIP Status Enumeration via csrutil status
Flags execution of "csrutil status" on macOS to enumerate System Integrity Protection state.
Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule TeamMacosprocess_creationLow92Free2024-01-02macOS csrutil Used to Disable System Integrity Protection (SIP)
Detects macOS processes running csrutil to disable SIP by matching /csrutil with a command line containing 'disable'.
Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule TeamMacosprocess_creationMedium131Free2024-01-02macOS Bash Pipelines Extract Image Bytes and Base64-Decode Output to a File
Alerts on bash on macOS that tails image bytes, base64-decodes them, and writes decoded output to a new file.
Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule TeamMacosprocess_creationHigh102Free2023-12-20macOS System Information Discovery via sw_vers with product/build flags
Detects sw_vers executions on macOS that request product name/version or build version details.
Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule TeamMacosprocess_creationMedium133Free2023-12-20macOS Process Discovery via ioreg I/O Kit Registry Queries
Flags macOS executions of ioreg with discovery-oriented arguments and device/vendor strings from command-line telemetry.
Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule TeamMacosprocess_creationMedium162Free2023-12-20macOS: In-Memory Download and Compile via curl and osacompile in a Single Command
Alerts when macOS processes include both curl and osacompile, consistent with downloading and compiling payloads.
Sohan G (D4rkCiph3r), Red Canary (idea), Huntrule TeamMacosprocess_creationMedium253Free2023-08-22macOS: JAMF CLI (jamf) execution for account and MDM management
Flags macOS executions of the JAMF CLI with command-line actions tied to account, MDM, and framework changes.
Jay Pandit, Huntrule TeamMacosprocess_creationLow151Free2023-08-22macOS Jamf MDM Suspicious Child Process Execution
Alerts when jamf on macOS spawns bash or sh, which may indicate misuse for command execution.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamMacosprocess_creationMedium349Free2023-08-22