Sigma detection rules, expert-reviewed
Each one is checked against the reporting it came from before it is published, and shows the ATT&CK technique it covers, the telemetry it needs and where it falls short.
153 rules
macOS XCSSET Execution Indicators via bash-launched curl, osacompile, plutil, or zip
Flags macOS process chains involving bash-driven curl plus osacompile/plutil/zip operations targeting user and Group Containers paths.
Tim Rauch (rule), Elastic (idea), Huntrule TeamMacosprocess_creationMedium482Free2022-10-17macOS Process Execution Traces Indicating WizardUpdate Downloader/C2 Staging
Flags macOS process creations showing curl+eval execution and intermediate agent indicators associated with WizardUpdate activity.
Tim Rauch (rule), Elastic (idea), Huntrule TeamMacosprocess_creationHigh223Free2022-10-17macOS: Built-in openssl used to base64-decode and decrypt payload from mounted DMG volume
Alerts on OpenSSL base64-decode/decrypt commands using DMG-mounted '/Volumes/' paths on macOS.
Tim Rauch (rule), Elastic (idea), Huntrule TeamMacosprocess_creationMedium427Free2022-10-17macOS: Process commands with trailing space in filename to evade matching
Alerts on macOS processes whose command line and image path end with a trailing space, a common filename masquerading trick.
remotephone, Huntrule TeamMacosprocess_creationLow122Free2021-11-20macOS firmwarepasswd Command-Line Manipulation
Alerts on firmwarepasswd usage on macOS indicating firmware password set, full, delete, or check actions.
Austin Songer @austinsonger, Huntrule TeamMacosprocess_creationMedium203Free2021-09-30macOS Emond Launch Daemon Rule Install Monitoring via plist and emondClients Paths
Alerts on macOS Emond rule plist or emond client database changes that may indicate persistence setup.
Alejandro Ortuno, oscd.community, Huntrule TeamMacosfile_eventMedium151Free2020-10-23macOS Remote System Discovery via arp or ping enumeration
Identifies macOS arp -a or ping to private/local IP ranges used for remote system enumeration.
Alejandro Ortuno, oscd.community, Huntrule TeamMacosprocess_creationInformational132Free2020-10-22macOS Network Service Enumeration via nc, netcat, nmap, or telnet
Flags macOS executions of nc/netcat, nmap, or telnet consistent with local or remote service enumeration.
Alejandro Ortuno, oscd.community, Huntrule TeamMacosprocess_creationLow142Free2020-10-21macOS AppleScript Execution via osascript with -e, .scpt, or .js
Flags osascript usage on macOS with -e and script indicators consistent with executing AppleScript.
Alejandro Ortuno, oscd.community, Huntrule TeamMacosprocess_creationMedium80Free2020-10-21macOS Gatekeeper bypass attempt using xattr to remove com.apple.quarantine
Flags macOS xattr usage that deletes the com.apple.quarantine extended attribute, consistent with a Gatekeeper bypass attempt.
Daniil Yugoslavskiy, oscd.community, Huntrule TeamMacosprocess_creationLow408Free2020-10-19macOS Shutdown/Reboot Command Execution via /shutdown, /reboot, or /halt Paths
Flags macOS process executions ending with shutdown, reboot, or halt indicating possible host power disruption.
Igor Fits, Mikhail Larin, oscd.community, Huntrule TeamMacosprocess_creationInformational235Free2020-10-19macOS System Network Connection Discovery via who, w, last, lsof, or netstat
Flags macOS process executions of who/w/last/lsof/netstat used to discover network or session information.
Daniil Yugoslavskiy, oscd.community, Huntrule TeamMacosprocess_creationInformational201Free2020-10-19macOS Security Software Discovery via grep of Known Security Software Names
Flags /usr/bin/grep on macOS when command lines include identifiers associated with security tools and agents.
Daniil Yugoslavskiy, oscd.community, Huntrule TeamMacosprocess_creationMedium336Free2020-10-19macOS Process Creation: grep 'password' or laZagne Credential Extraction
Detects macOS executions of grep targeting 'password' strings and laZagne, suggesting local credential extraction attempts.
Igor Fits, Mikhail Larin, oscd.community, Huntrule TeamMacosprocess_creationHigh121Free2020-10-19macOS File and Directory Discovery via System Utilities
Detects macOS usage of file, ls -R, find, mdfind, or tree for file/directory enumeration.
Daniil Yugoslavskiy, oscd.community, Huntrule TeamMacosprocess_creationInformational203Free2020-10-19