macos Sigma detection rules

Detects suspicious activity associated with Atomic MacOS Stealer (Amos) campaigns, including execution of FileGrabber and curl-based POST requests used for data exfiltration. The rule identifies either the execution of FileGrabber targeting /tmp or the use of curl to POST sensitive user data (including files such as /tmp/out.zip) to remote servers, which are key indicators of Amos infostealer activity.

macos · process_creation

Detects creation of persistence artifacts placed by Atomic MacOS Stealer in macOS systems. Recent Atomic MacOS Stealer variants have been observed dropping these to maintain persistent access after compromise.

macos · file_event

Detects file creation events linked to the Axios NPM supply chain compromise on macOS devices. Axios is a popular JavaScript HTTP client. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper.

macos · file_event

Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup.

macos · process_creation

Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This rule detect using dd and truncate to add a junk data to file.

macos · process_creation

Detecting attempts to extract passwords with grep and laZagne

macos · process_creation

Detects possible malicious execution of JXA in-memory via OSAScript

macos · process_creation

Detects potential suspicious run-only executions compiled using OSACompile

macos · process_creation

Detects the use of tail to extract bytes at an offset from an image and then decode the base64 value to create a new file with the decoded content. The detected execution is a bash one-liner.

macos · process_creation

Detects potential persistence activity using LaunchAgents or LaunchDaemons via the PlistBuddy utility

macos · process_creation

Detects the execution traces of the WizardUpdate malware. WizardUpdate is a macOS trojan that attempts to infiltrate macOS machines to steal data and it is associated with other types of malicious payloads, increasing the chances of multiple infections on a device.

macos · process_creation

Detects the execution of a renamed instance of the Remote Monitoring and Management (RMM) tool, MeshAgent. RMM tools such as MeshAgent are commonly utilized by IT administrators for legitimate remote support and system management. However, malicious actors may exploit these tools by renaming them to bypass detection mechanisms, enabling unauthorized access and control over compromised systems.

macos · process_creation

Detects suspicious child processes spawning from microsoft office suite applications such as word or excel. This could indicates malicious macro execution

macos · process_creation

Detects access to clipboard content via osascript, which may be used for data collection but also occurs in legitimate clipboard utilities and automation scripts

macos · process_creation

Detects execution of the "pbpaste" utility, which retrieves the contents of the clipboard (a.k.a. pasteboard) and writes them to the standard output (stdout). The utility is often used for creating new files with the clipboard content or for piping clipboard contents to other commands. It can also be used in shell scripts that may require clipboard content as input. Attackers can abuse this utility in order to collect data from the user clipboard, which may contain passwords or sensitive information. Use this rule to hunt for potential abuse of the utility by looking at the parent process and any potentially suspicious command line content.

macos · process_creation

Detects passwords dumps from Keychain

macos · process_creation

Detects disabling security tools

macos · process_creation

Detects the execution of the hdiutil utility in order to create a disk image.

macos · process_creation

Detects the execution of the hdiutil utility in order to mount disk images.

macos · process_creation

Detects the execution of the nscurl utility in order to download files.

macos · process_creation

Detect file time attribute change to hide new or changes to existing files

macos · process_creation

Detects the execution of the "chflags" utility with the "hidden" flag, in order to hide files on MacOS. When a file or directory has this hidden flag set, it becomes invisible to the default file listing commands and in graphical file browsers.

macos · process_creation

Detects creation of a hidden user account on macOS (UserID < 500) or with IsHidden option

macos · process_creation

Detects deletion of local audit logs

macos · process_creation

Detects potential suspicious child processes of "jamf". Could be a sign of potential abuse of Jamf as a C2 server as seen by Typhon MythicAgent.

macos · process_creation

Detects the execution of programs as Launch Agents or Launch Daemons using launchctl on macOS.

macos · process_creation

Detects additions to the Emond Launch Daemon that adversaries may use to gain persistence and elevate privileges.

macos · file_event

Detects execution of AppleScript of the macOS scripting language AppleScript.

macos · process_creation

Detects the addition of a new file or path exclusion to MacOS Time Machine via the "tmutil" utility. An adversary could exclude a path from Time Machine backups to prevent certain files from being backed up.

macos · process_creation

Detects potential suspicious applet or osascript executing "osacompile".

macos · process_creation

Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.

macos · process_creation

Detects usage of "find" binary in a suspicious manner to perform discovery

macos · process_creation

Detects potential in-memory downloading and compiling of applets using curl and osacompile as seen used by XCSSET malware

macos · process_creation

Identifies the execution traces of the XCSSET malware. XCSSET is a macOS trojan that primarily spreads via Xcode projects and maliciously modifies applications. Infected users are also vulnerable to having their credentials, accounts, and other vital data stolen.

macos · process_creation

Detects creation of a Python path configuration file (.pth) in Python library folders, which can be maliciously abused for code execution and persistence. Modules referenced by these files are run at every Python startup (v3.5+), regardless of whether the module is imported by the calling script. Default paths are '\lib\site-packages\*.pth' (Windows) and '/lib/pythonX.Y/site-packages/*.pth' (Unix and macOS).

macos · file_event

Detects potential execution of MeshAgent which is a tool used for remote access. Historical data shows that threat actors rename MeshAgent binary to evade detection. Matching command lines with the '--meshServiceName' argument can indicate that the MeshAgent is being used for remote access.

macos · process_creation

Detects attempts to enable the root account via "dsenableroot"

macos · process_creation

Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detection will focus on crontab jobs uploaded from the tmp folder.

macos · process_creation

Detects usage of system utilities (only grep for now) to discover security software discovery

macos · process_creation

Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.

macos · process_creation

Detects when the macOS Script Editor utility spawns an unusual child process.

macos · process_creation

Detects commandline operations on shell history files

macos · process_creation

Detects the execution of suspicious child processes from macOS installer package parent process. This includes osascript, JXA, curl and wget amongst other interpreters

macos · process_creation

Detects when a user manipulates with Firmward Password on MacOS. NOTE - this command has been disabled on silicon-based apple computers.

macos · process_creation

Detects the use of "ioreg" which will show I/O Kit registry information. This process is used for system information discovery. It has been observed in-the-wild by calling this process directly or using bash and grep to look for specific strings.

macos · process_creation

Detects the use of "sw_vers" for system information discovery

macos · process_creation

Detects the execution of "system_profiler" with specific "Data Types" that have been seen being used by threat actors and malware. It provides system hardware and software configuration information. This process is primarily used for system information discovery. However, "system_profiler" can also be used to determine if virtualization software is being run for defense evasion purposes.

macos · process_creation

Detects the execution of "sysctl" with specific arguments that have been used by threat actors and malware. It provides system hardware information. This process is primarily used to detect and avoid virtualization and analysis environments.

macos · process_creation

Detects the use of csrutil to disable the Configure System Integrity Protection (SIP). This technique is used in post-exploit scenarios.

macos · process_creation

Detects deletion attempts of MacOS Time Machine backups via the native backup utility "tmutil". An adversary may perform this action before launching a ransonware attack to prevent the victim from restoring their files.

macos · process_creation

Detects disabling of Time Machine (Apple's automated backup utility software) via the native macOS backup utility "tmutil". An attacker can use this to prevent backups from occurring.

macos · process_creation

Detects attempts to create and add an account to the admin group via "dscl"

macos · process_creation

Detects attempts to create and/or add an account to the admin group, thus granting admin privileges.

macos · process_creation

Detects attempts to create and add an account to the admin group via "sysadminctl"

macos · process_creation

Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.

macos · process_creation

Detects usage of base64 utility to decode arbitrary base64-encoded text

macos · process_creation

Detects macOS Gatekeeper bypass via xattr utility

macos · process_creation

Detects attempts to enable the guest account using the sysadminctl utility

macos · process_creation

Detects attempts to use system dialog prompts to capture user credentials

macos · process_creation

Detects execution of the "jamf" binary to create user accounts and run commands. For example, the binary can be abused by attackers on the system in order to bypass security controls or remove application control polices.

macos · process_creation

Detects enumeration of local system accounts on MacOS systems. This can be used by attackers to identify accounts for lateral movement or privilege escalation.

macos · process_creation

Detects enumeration of local or remote network services.

macos · process_creation

Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.

macos · process_creation

Detects attempts to use screencapture to collect macOS screenshots

macos · process_creation

Detects attempts to masquerade as legitimate files by adding a space to the end of the filename.

macos · process_creation

Detection use of the command "split" to split files into parts and possible transfer.

macos · process_creation

Detects the creation of a startup item plist file, that automatically get executed at boot initialization to establish persistence. Adversaries may use startup items automatically executed at boot initialization to establish persistence. Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items.

macos · file_event

Detects the use of csrutil to view the Configure System Integrity Protection (SIP) status. This technique is used in post-exploit scenarios.

macos · process_creation

Detects usage of system utilities to discover files and directories

macos · process_creation

Detects enumeration of local system groups

macos · process_creation

Detects the enumeration of other remote systems.

macos · process_creation

Detects the usage of tooling to sniff network traffic. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.

macos · process_creation

Detects usage of system utilities to discover system network connections

macos · process_creation

Detects enumeration of local network configuration

macos · process_creation

Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.

macos · process_creation