Sigma detection rules, expert-reviewed

Malicious Bad Apples Data Exfiltration via snmptrap OID

This rule detects snmptrap sending data to the attacker-specific enterprise OID 1.3.6.1.4.1.99999, matching the Bad Apples abuse of native macOS SNMP tooling to smuggle collected data out over an alternate protocol. Encoding stolen information inside SNMP trap fields evades controls focused on HTTP and DNS exfiltration. Use of this fabricated OID with snmptrap indicates covert exfiltration.

Suspicious Remote Script Downloaded via curl and Piped to Shell (via process_creation)

This rule detects a curl download piped directly into a shell in a single command line, the download-and-execute pattern used by the updated XCSSET malware to retrieve and run stage payloads from attacker infrastructure. Adversaries chain curl into sh to fetch and execute code without writing a script to disk, so this one-liner is a strong indicator of remote payload execution on macOS.

Suspicious File Download to tmp and Quarantine Removal via curl and xattr

This rule detects a shell command that downloads a file into the tmp directory with curl, strips the macOS quarantine attribute with xattr, marks it executable and runs it. This chain is the macOS infection path from fake Claude Code advertisements delivering an AMOS style stealer.

Malicious macOS Payload Download and Execution via curl Piped to zsh

This rule detects a remote payload being downloaded with curl and immediately piped into the zsh or sh shell for execution on macOS. This loader behavior was used by the MacSync stealer and RAT documented by Huntress to fetch and run its second stage without touching disk. Piping downloaded content straight into an interpreter is a hallmark of fileless staging and warrants investigation.

Obfuscated Base64-Decoded Payload Piped to Shell via macOS ClickFix Terminal Lure (via process_creation)

This rule detects a terminal one-liner that base64-decodes an embedded payload and pipes it into a shell, the macOS ClickFix execution behavior tricking users into pasting commands into Terminal. Adversaries leverage inline base64 decoding to hide the downloader and run it without writing an obvious script to disk.

Malicious Lazarus RustyAttr Payload Retrieval via curl to Support Cloudstore C2 (via process_creation)

This rule detects the macOS curl download used by Lazarus RustyAttr activity to fetch a shell payload over an insecure -L -k connection from support.cloudstore.business or support.docsend.site as reported by Group-IB. Adversaries retrieve the second-stage script from this infrastructure before executing it through AppleScript, making this an early indicator of the intrusion.

Suspicious macOS Quarantine Attribute Removal via xattr (via process_creation)

This rule detects xattr removing the com.apple.quarantine attribute from a file. Stripping this attribute clears the download provenance that triggers Gatekeeper checks allowing a downloaded payload to launch without warning. Attackers use this to make internet-sourced binaries appear locally trusted.

Suspicious Shell Password Gathering Referencing System Preferences (via process_creation)

This rule detects a shell command line referencing both system preferences and password, the shell-based credential-gathering pattern Red Canary associated with Atomic Stealer on macOS. This wording is used to coax users into entering their password while impersonating a system settings prompt, so its appearance warrants review for credential theft.

Suspicious macOS Keychain Credential Dump via security Utility (via process_creation)

This rule detects the macOS security command being used to dump keychain contents with the dump-keychain switch and the decrypt flag. Attackers abuse this built-in utility to extract stored passwords and secrets from the user keychain. Requesting a decrypted dump of all keychain items is a hallmark of credential theft on macOS.

Suspicious macOS Trojan-Proxy LaunchAgent GoogleHelperUpdater Persistence (via file_event)

This rule detects creation of a LaunchAgent property list named GoogleHelperUpdater.plist. The macOS Trojan-Proxy bundled with cracked software installs this masquerading Google-branded LaunchAgent to persist and relay traffic through the victim host, so this plist name in a LaunchAgents directory indicates the proxy implant establishing persistence.

Malicious macOS LaunchAgent Persistence com.nvm.protocal.plist

This rule detects creation of a LaunchAgent property list named com.nvm.protocal.plist, the macOS persistence dropped by the Mastra npm supply chain compromise. The plist impersonates a Node version manager helper to relaunch the malicious payload at every user login.

Possible ExifTool CVE-2026-3102 Command Injection via Child Process Spawn (via process_creation)

This rule detects exiftool spawning setfile or a shell interpreter as a child process, the command injection sink exploited in CVE-2026-3102 when a crafted image reaches the SetMacOSTags system call. The injected command runs attacker controlled code on macOS during metadata processing. Detecting exiftool as the parent of these processes surfaces exploitation of the vulnerability.

Malicious SUGARLOADER Configuration Masquerading as Safari Cache via File Event

This rule detects creation of a com.apple.safari.ck file in the Library Caches directory which is the RC4 encrypted configuration written by the SUGARLOADER stage of the KANDYKORN intrusion. The filename masquerades as a legitimate Safari cache to hide malware configuration on macOS hosts.

ClickFix macOS Payload Retrieval via curl Insecure Flags Piped to Shell (via process_creation)

This rule detects the macOS ClickFix chain where curl downloads a payload with insecure combined flags and pipes it directly into a shell for execution. Adversaries leverage the kfsSL flag bundle to silently bypass TLS validation and follow redirects before running the fetched script, making the curl-piped-to-shell pattern a high-confidence execution indicator.

Suspicious Security Software Enumeration on macOS

This rule detects enumeration of macOS security tooling such as Little Snitch, a discovery step malware performs to detect network monitoring and endpoint defenses before proceeding. Identifying protective software lets the malware adjust behavior or avoid noisy network activity.