Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
153 rules
macOS Root Account Enable Attempt via dsenableroot
Detects macOS attempts to enable the root account by running /dsenableroot.
Sohan G (D4rkCiph3r), Huntrule TeamMacosprocess_creationMedium396Free2023-08-22macOS dseditgroup Used to Add User to admin Group
Flags dseditgroup command lines that edit and add a user to the macOS admin group.
Sohan G (D4rkCiph3r), Huntrule TeamMacosprocess_creationMedium315Free2023-08-22Suspicious Child Processes Spawned by Browsers on macOS
Alerts on browser-launched child processes on macOS where the child is a shell or scripting/utility binary, excluding known benign browser scripts.
Sohan G (D4rkCiph3r), Huntrule TeamMacosprocess_creationMedium142Free2023-04-05macOS: Process execution of osacompile by applet/osascript child processes
Flags macOS applet or osascript processes launching command lines that contain osacompile.
Sohan G (D4rkCiph3r), Red Canary (Idea), Huntrule TeamMacosprocess_creationMedium125Free2023-04-03macOS sysadminctl Used to Add User to Admin Group
Alerts when sysadminctl is used with -addUser and -admin to add a user to the macOS admin group.
Sohan G (D4rkCiph3r), Huntrule TeamMacosprocess_creationMedium113Free2023-03-19macOS dscl Adds User to Admin Group via -append /Groups/admin GroupMembership
Flags dscl commands on macOS that append a user into the local admin group membership.
Sohan G (D4rkCiph3r), Huntrule TeamMacosprocess_creationMedium2010Free2023-03-19macOS: Guest account enabled via sysadminctl
Flags sysadminctl command lines that appear to activate the macOS guest account.
Sohan G (D4rkCiph3r), Huntrule TeamMacosprocess_creationLow323Free2023-02-18macOS Persistence Attempt Using PlistBuddy to Modify LaunchAgents/LaunchDaemons
Identifies PlistBuddy commands that enable RunAtLoad for LaunchAgents or LaunchDaemons persistence on macOS.
Sohan G (D4rkCiph3r), Huntrule TeamMacosprocess_creationHigh161Free2023-02-18macOS Installer Scripts Spawning Suspicious Interpreter Child Processes
Alerts when macOS installer scripts (preinstall/postinstall) spawn shell, scripting, osascript, curl, or wget processes.
Sohan G (D4rkCiph3r), Huntrule TeamMacosprocess_creationMedium112Free2023-02-18macOS OSACompile Run-Only Script Execution
Flags osacompile commands on macOS using run-only (-x) with inline script (-e) execution.
Sohan G (D4rkCiph3r), Huntrule TeamMacosprocess_creationHigh511Free2023-01-31macOS Office Apps Spawning Shell or Scripting Processes
Alerts when Microsoft Office on macOS launches suspicious shell/script or download utilities as child processes.
Sohan G (D4rkCiph3r), Huntrule TeamMacosprocess_creationHigh289Free2023-01-31macOS JXA In-Memory Execution via osascript JavaScript eval and NSData URL loading
Detects osascript-launched in-memory JXA JavaScript execution patterns using eval and URL-based data loading.
Sohan G (D4rkCiph3r), Huntrule TeamMacosprocess_creationHigh153Free2023-01-31macOS osascript Clipboard Access via AppleScript Commands
Alerts on osascript commands that reference the system clipboard, which may indicate collection or automation misuse on macOS.
Sohan G (D4rkCiph3r), Huntrule TeamMacosprocess_creationMedium122Free2023-01-31macOS Process Creation: Suspicious find Usage for Permission/Setuid Discovery
Alerts on macOS executions of /find containing permission enumeration flags for setuid/setgid and writable/executable files.
Nasreddine Bencherchali (Nextron Systems), Huntrule TeamMacosprocess_creationMedium121Free2022-12-28macOS Script Editor Spawns Suspicious Command-Line Interpreters
Alerts when Script Editor launches command-line tools or interpreters like curl, shell binaries, python, or perl.
Tim Rauch (rule), Elastic (idea), Huntrule TeamMacosprocess_creationMedium162Free2022-10-21