macOS coverage

405 of 625 macOS detection rules across 4 vendors map to a specific Endpoint Security event; the remaining 220 are grouped by MITRE technique.

Attributed to an ESF event

405 rules that resolve to a specific Endpoint Security event type, grouped by Apple's functional-domain section.

File System Events 90 rules, 4 event types

File Open 33 rules

Cloud Credential Files Accessed by Osascript elastic T1552, T1552.001
Cloud Credential Files Accessed by Process in Suspicious Directory elastic T1552, T1552.001
Crypto Wallet File Access by Unsigned or Untrusted Binary elastic T1552, T1552.001
Crypto Wallet or Web Browser File Access via Nodejs elastic T1552, T1552.001
Crypto Wallet or Web Browser File Access via Osascript elastic T1552, T1552.001
Crypto Wallet or Web Browser File Access via Python elastic T1552, T1552.001
Crypto Wallet or Web Browser File Access via SSH elastic T1552, T1552.001
First Time Python Accessed Sensitive Credential Files elastic, medium T1539, T1552, T1552.001, T1555, T1555.001, T1558
Full Disk Access Permission Check elastic, medium T1083, T1548, T1548.006
GenAI Process Accessing Sensitive Files elastic, high T1005, T1037, T1037.004, T1552, T1552.001, T1555
Kerberos Config File Accessed by Osascript elastic T1059, T1059.002, T1082
Kerberos Config File Accessed by Untrusted or Unsigned Process elastic T1649
Mach-O File with Unusual Extension elastic T1036
Potential Python Stealer elastic T1059, T1059.006, T1552, T1552.001
Sensitive File Access followed by Compression elastic, high T1005, T1074, T1074.001, T1560
Sensitive File Access via Perl elastic T1059, T1059.004, T1552, T1552.001
Sensitive File Access via Rsync elastic T1005, T1048
Slack Workspace Files Accessed by Osascript elastic T1552, T1552.008
Slack Workspace Files Accessed by Unsigned or Untrusted Process elastic T1552, T1552.008
SSH Keys Accessed by Osascript elastic T1552, T1552.004
Suspicious User Keychain Access via Nodejs elastic T1555, T1555.001
Suspicious User Keychain DB Access by Unsigned Binary elastic T1555, T1555.001
Suspicious Web Browser Sensitive File Access elastic, high T1005, T1539, T1555, T1555.003
System and Network Configuration Check elastic, medium T1016, T1082
Telegram Data Accessed by Osascript elastic T1552, T1552.001
Telegram Data Accessed by Unsigned or Untrusted Process elastic T1552, T1552.001
User Keychain Access in Unusual Location elastic T1555, T1555.001
User Keychain DB Access by Osascript elastic T1555, T1555.001
User Keychain DB Access by Self-Signed Binary elastic T1555, T1555.001
User TCC DB Access by Osascript elastic T1059, T1059.002, T1069, T1082, T1106, T1548
+3 more

File or Directory Create 10 rules

Atomic MacOS Stealer - Persistence Indicators sigma, high T1543, T1543.004, T1564, T1564.001
Axios NPM Compromise File Creation Indicators - MacOS sigma, high T1105, T1195, T1195.002
Disk Image Download and Mount via Hdiutil elastic T1059, T1105, T1204, T1204.002, T1218
GenAI Process Accessing Sensitive Files elastic, high T1005, T1037, T1037.004, T1552, T1552.001, T1555
Initial Access via File Upload Followed by GET Request elastic, medium T1105, T1190, T1505, T1505.003
MacOS Emond Launch Daemon sigma, medium T1546, T1546.014
macOS ESF Suspicious File Creation in Persistence Locations sigma, high
Potential Execution via VS Code Tasks elastic T1195, T1195.001, T1566, T1566.002
Python Path Configuration File Creation - MacOS sigma, medium T1059, T1059.006
Startup Item File Created - MacOS sigma, low T1037, T1037.005

File Rename 6 rules

File Write 54 rules

Application Javascript Injection via Nodejs elastic T1055, T1195, T1195.001, T1554
Authorization Plugin Modification elastic, medium T1547, T1547.002, T1556
Curl Executable File Download via Osascript elastic T1105
Curl Hidden Binary Modification via Osascript elastic T1059, T1059.002, T1105
Decoy Document Creation via Curl elastic T1204, T1204.002
Discovery Command Output Written to Suspicious File elastic, medium T1016, T1033, T1074, T1074.001, T1082
Disk Image Download and Mount via Hdiutil elastic T1059, T1105, T1204, T1204.002, T1218
Embedded Payload Dropped and Executed elastic T1027, T1027.009
Emond Rules Creation or Modification elastic, medium T1546, T1546.014
Executable File Creation via Base64 elastic T1027, T1140
Executable File Download via Wget elastic, medium T1105, T1204, T1204.002
Executable File Modification via SSH elastic T1059, T1059.004, T1105
Exfiltration Data Staging in Temporary Directory via Osascript elastic T1119
File Download from Suspicious Top Level Domain elastic T1071, T1071.001
File Download Piped to Script Interpreter elastic T1059
GenAI Process Accessing Sensitive Files elastic, high T1005, T1037, T1037.004, T1552, T1552.001, T1555
Hidden AppleScript Download via Curl elastic T1105, T1564, T1564.001
Hidden File Network Connection and Executable Download elastic T1105
Mach-O File with Unusual Extension elastic T1036
Osascript Payload Drop and Execute elastic T1105
Perl Script File Creation or Modification elastic T1059, T1059.004
Persistence via DirectoryService Plugin Modification elastic, medium T1547, T1574
Persistence via Docker Shortcut Modification elastic, medium T1543, T1547, T1547.009
Potential Data Collection in Temporary Directory by Hidden Executable elastic T1560, T1560.003
Potential Etherhiding C2 via Blockchain Connection elastic, high T1059, T1059.002, T1059.004, T1059.006, T1059.007, T1102
Potential Execution via VS Code Tasks elastic T1195, T1195.001, T1566, T1566.002
Potential Microsoft Office Sandbox Evasion elastic, high T1036, T1036.005, T1497
Potential Persistence via Atom Init Script Modification elastic, low T1037, T1546
Potential Persistence via Periodic Tasks elastic, low T1053, T1053.003
Privilege Escalation via Root Crontab File Modification elastic, high T1053, T1053.003
+24 more

Symbolic Link Events 6 rules, 1 event type

File Unlink 6 rules

Process Events 326 rules, 3 event types

Process Execution 322 rules

Abnormally Large Javascript Evaluation via Nodejs elastic T1059, T1059.007
Abnormally Large Shell Script Execution via Perl elastic T1059, T1059.004
Account or Group Discovery via Built-In Tools elastic, low T1069, T1069.001, T1069.002, T1087, T1087.001, T1087.002
AppleScript Decoded via Base64 elastic T1027, T1059, T1059.002, T1140
Arbitrary Python Code Execution via Nodejs elastic T1059, T1059.006
Atomic MacOS Stealer - FileGrabber Activity sigma, high T1059, T1059.002
Attempt to establish VScode Remote Tunnel elastic T1059, T1059.001, T1059.003, T1059.004, T1102, T1102.002
AWS SSM `SendCommand` with Run Shell Command Parameters elastic, medium T1059, T1059.001, T1059.004, T1651
AWS SSM Session Manager Child Process Execution elastic, medium T1059, T1059.001, T1059.004, T1651
Axios NPM Compromise Indicators - macOS sigma, high T1059, T1059.002, T1059.004, T1105, T1195, T1195.002
Background Process Execution via Shell elastic T1059, T1059.004
Base64 Encoded String Execution via Osascript elastic T1027, T1059, T1059.002, T1140
Binary Padding - MacOS sigma, high T1027, T1027.001
Clipboard Access Via OSAScript sigma, medium T1059, T1059.002, T1115
Clipboard accessed by Unsigned or Untrusted Binary elastic T1115
Clipboard Data Collection Via Pbpaste sigma, medium T1115
Cocoa Applet Binary Execution elastic T1059, T1059.002
Code Editor Untrusted or Unsigned Child Process Execution elastic T1059, T1059.004
Command Execution via Screen Session elastic T1059, T1059.004
Creation Of A Local User Account sigma, low T1136, T1136.001
Credentials from Password Stores - Keychain sigma, medium T1555, T1555.001
Credentials In Files sigma, high T1552, T1552.001
Crypto Wallet File Access via CommandLine elastic T1552, T1552.001
Curl Download and Execution of JavaScript Payload elastic T1059, T1059.007
Curl Download and OsaScript Payload Execution via Node elastic T1105
Curl Execution via Application Shell Script elastic T1105
Curl Execution via CommandLine Shell Script elastic T1105
Curl Execution via Shell Profile elastic, high T1059, T1059.004, T1105, T1546, T1546.004
Curl Hidden Binary Modification via Osascript elastic T1059, T1059.002, T1105
Curl Local File Read or Write via Osascript elastic T1105
+292 more

Process Fork 7 rules

Signal Delivery 3 rules

Mass Process Termination sigma, high T1489
Process Signal from Suspicious Parent Process sigma, medium T1059
SIGKILL Sent to Security Tools sigma, high T1685

Kernel Events 3 rules, 2 event types

Kernel Extension Load 3 rules

Kernel Extension Loaded from Temporary Directory sigma, critical T1547, T1547.006
Suspicious Kernel Extension Names sigma, high T1014
Unsigned Kernel Extension Load Attempt sigma, critical T1547, T1547.006

Kernel Extension Unload 3 rules

Kernel Extension Loaded from Temporary Directory sigma, critical T1547, T1547.006
Suspicious Kernel Extension Names sigma, high T1014
Unsigned Kernel Extension Load Attempt sigma, critical T1547, T1547.006

XPC Events 3 rules, 1 event type

XPC Service Connection 3 rules

Connection to Suspicious XPC Service sigma, high T1559
XPC Connection from Unusual Location sigma, medium T1559
XPC Privilege Escalation Attempt sigma, medium T1068

Authentication Events 1 rule, 1 event type

sudo Command Execution 1 rule

macOS UL Sudo Command Execution sigma, low

TCC Events 1 rule, 1 event type

TCC Privacy Permission Modified 1 rule

macOS UL Unusual TCC Access Request sigma, medium

Not attributed to an ESF event

220 rules that target macOS but resolve to no specific Endpoint Security event (generic process / command-line fields with no ESF event signal), grouped by the MITRE technique they detect.

Resource Development 2 rules, 2 techniques

T1587.001 Develop Capabilities: Malware 1 rule

GenAI Process Compiling or Generating Executables elastic, medium T1027, T1027.004, T1587, T1587.001

T1588 Obtain Capabilities 1 rule

macOS Malware Detected with osquery panther, medium T1588

Initial Access 10 rules, 8 techniques

T1078 Valid Accounts 1 rule

macOS Authentication Events sigma, low T1078, T1555

T1078.004 Valid Accounts: Cloud Accounts 1 rule

macOS SSH Connection Detection sigma, medium T1021, T1021.004, T1078, T1078.004

T1091 Replication Through Removable Media 1 rule

New USB Storage Device Mounted elastic, low T1052, T1052.001, T1091

T1133 External Remote Services 3 rules

Ollama API Accessed from External Network elastic, medium T1133, T1190
Potential macOS SSH Brute Force Detected elastic, medium T1110, T1133
Virtual Private Network Connection Attempt elastic, low T1021, T1133

T1189 Drive-by Compromise 1 rule

Suspicious Browser Child Process elastic, high T1059, T1059.001, T1059.002, T1059.004, T1059.006, T1105

T1190 Exploit Public-Facing Application 2 rules

Ollama API Accessed from External Network elastic, medium T1133, T1190
Potential JAVA/JNDI Exploitation Attempt elastic, high T1059, T1059.004, T1059.006, T1059.007, T1190, T1203

T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools 2 rules

A backdoored version of XZ or liblzma is vulnerable to CVE-2024-3094 panther, high T1195.001
Ollama DNS Query to Untrusted Domain elastic, low T1105, T1195, T1195.001, T1195.002

T1195.002 Supply Chain Compromise: Compromise Software Supply Chain 1 rule

Ollama DNS Query to Untrusted Domain elastic, low T1105, T1195, T1195.001, T1195.002

Execution 56 rules, 18 techniques

T1053.002 Scheduled Task/Job: At 1 rule

At Job Creation or Modification via Shell Command elastic T1053, T1053.002

T1053.003 Scheduled Task/Job: Cron 2 rules

Cron Tab Creation or Modification via Shell Command elastic T1053, T1053.003
Suspicious CronTab Creation or Modification elastic, medium T1053, T1053.003

T1059 Command and Scripting Interpreter 5 rules

GenAI or MCP Server Child Process Execution elastic, low T1059
macOS Network Utility Tools for C2 sigma, high T1059, T1071
Persistence via Folder Action Script elastic, medium T1037, T1059, T1546
Possible JAVA Reverse Shell elastic T1059, T1071
Potential Reverse Shell Activity via Terminal elastic, high T1059, T1095

T1059.001 Command and Scripting Interpreter: PowerShell 8 rules

Command Line Obfuscation via Whitespace Padding elastic, medium T1027, T1027.010, T1059, T1059.001, T1140
Execution via OpenClaw Agent elastic, medium T1059, T1059.001, T1059.002, T1059.003, T1059.004, T1059.006
Execution with Explicit Credentials via Scripting elastic, medium T1059, T1059.001, T1059.002, T1059.004, T1059.006, T1078
Long Base64 Encoded Command via Scripting Interpreter elastic, high T1027, T1059, T1059.001, T1059.006, T1059.007, T1140
Powershell Encoded Command elastic T1059, T1059.001
Suspicious Browser Child Process elastic, high T1059, T1059.001, T1059.002, T1059.004, T1059.006, T1105
Suspicious Emond Child Process elastic, medium T1059, T1059.001, T1059.002, T1059.004, T1059.006, T1546
Suspicious Powershell Child Process elastic T1059, T1059.001

T1059.002 Command and Scripting Interpreter: AppleScript 11 rules

Apple Script Execution followed by Network Connection elastic, medium T1059, T1059.002, T1071, T1105
Apple Scripting Execution with Administrator Privileges elastic, medium T1059, T1059.002, T1078, T1548, T1548.004
Creation of Hidden Login Item via Apple Script elastic, medium T1059, T1059.002, T1547, T1547.015, T1647
Executable File Access or Modification via Osascript elastic T1059, T1059.002, T1105
Execution via OpenClaw Agent elastic, medium T1059, T1059.001, T1059.002, T1059.003, T1059.004, T1059.006
Execution with Explicit Credentials via Scripting elastic, medium T1059, T1059.001, T1059.002, T1059.004, T1059.006, T1078
Google Calendar C2 via Script Interpreter elastic, high T1059, T1059.002, T1059.006, T1059.007, T1102, T1102.001
MacOS AMOS Stealer - Virtual Machine Check Activity splunk, low T1059, T1059.002
Suspicious AWS S3 Connection via Script Interpreter elastic, medium T1059, T1059.002, T1059.006, T1059.007, T1102, T1567
Suspicious Browser Child Process elastic, high T1059, T1059.001, T1059.002, T1059.004, T1059.006, T1105
Suspicious Emond Child Process elastic, medium T1059, T1059.001, T1059.002, T1059.004, T1059.006, T1546

T1059.003 Command and Scripting Interpreter: Windows Command Shell 2 rules

Execution via OpenClaw Agent elastic, medium T1059, T1059.001, T1059.002, T1059.003, T1059.004, T1059.006
Silent NPM Package Install Command elastic T1059, T1059.003, T1059.004

T1059.004 Command and Scripting Interpreter: Unix Shell 19 rules

Abnormal Auval Child Process Execution elastic T1059, T1059.004
Executable File Extracted to Temporary Directory elastic T1059, T1059.004
Execution via OpenClaw Agent elastic, medium T1059, T1059.001, T1059.002, T1059.003, T1059.004, T1059.006
Execution with Explicit Credentials via Scripting elastic, medium T1059, T1059.001, T1059.002, T1059.004, T1059.006, T1078
Hidden Folder or File Access in Tmp via Python elastic T1059, T1059.004, T1059.006
MacOS Hidden File Mounted elastic T1059, T1059.004, T1211
MacOS LOLbin splunk, medium T1059, T1059.004
Nohup Execution followed by Outbound Network Connection elastic T1059, T1059.004, T1564, T1564.003
Potential JAVA/JNDI Exploitation Attempt elastic, high T1059, T1059.004, T1059.006, T1059.007, T1190, T1203
Silent NPM Package Install Command elastic T1059, T1059.003, T1059.004
Suspicious Audio Unit Plug-in File Access elastic T1059, T1059.004
Suspicious Browser Child Process elastic, high T1059, T1059.001, T1059.002, T1059.004, T1059.006, T1105
Suspicious Emond Child Process elastic, medium T1059, T1059.001, T1059.002, T1059.004, T1059.006, T1546
Suspicious File Creation via Pkg Install Script elastic, high T1059, T1059.004, T1546, T1546.016
Suspicious OpenSSL Execution via macOS Application elastic T1027, T1059, T1059.004, T1140, T1204, T1204.002
Suspicious Perl File Modification elastic T1059, T1059.004, T1564, T1564.001
Suspicious XPC Service Child Process elastic T1059, T1059.004, T1559, T1559.003
Unsigned or Untrusted Application Launch via XPC elastic T1059, T1059.004, T1559, T1559.003
VScode Extension Install via URI Handler elastic T1059, T1059.004, T1204, T1204.001

T1059.006 Command and Scripting Interpreter: Python 12 rules

Execution via OpenClaw Agent elastic, medium T1059, T1059.001, T1059.002, T1059.003, T1059.004, T1059.006
Execution with Explicit Credentials via Scripting elastic, medium T1059, T1059.001, T1059.002, T1059.004, T1059.006, T1078
Google Calendar C2 via Script Interpreter elastic, high T1059, T1059.002, T1059.006, T1059.007, T1102, T1102.001
Hidden Folder or File Access in Tmp via Python elastic T1059, T1059.004, T1059.006
Long Base64 Encoded Command via Scripting Interpreter elastic, high T1027, T1059, T1059.001, T1059.006, T1059.007, T1140
Potential JAVA/JNDI Exploitation Attempt elastic, high T1059, T1059.004, T1059.006, T1059.007, T1190, T1203
Python Path Configuration File (.pth) with Import Preface elastic T1059, T1059.006, T1546
ROT Encoded Python Script Execution elastic, medium T1027, T1027.013, T1059, T1059.006, T1140
Suspicious AWS S3 Connection via Script Interpreter elastic, medium T1059, T1059.002, T1059.006, T1059.007, T1102, T1567
Suspicious Browser Child Process elastic, high T1059, T1059.001, T1059.002, T1059.004, T1059.006, T1105
Suspicious Emond Child Process elastic, medium T1059, T1059.001, T1059.002, T1059.004, T1059.006, T1546
Unusual Library Load via Python elastic, high T1059, T1059.006, T1129

T1059.007 Command and Scripting Interpreter: JavaScript 7 rules

Execution via Electron Child Process Node.js Module elastic, medium T1059, T1059.007, T1548
Execution via OpenClaw Agent elastic, medium T1059, T1059.001, T1059.002, T1059.003, T1059.004, T1059.006
Google Calendar C2 via Script Interpreter elastic, high T1059, T1059.002, T1059.006, T1059.007, T1102, T1102.001
Long Base64 Encoded Command via Scripting Interpreter elastic, high T1027, T1059, T1059.001, T1059.006, T1059.007, T1140
Potential JAVA/JNDI Exploitation Attempt elastic, high T1059, T1059.004, T1059.006, T1059.007, T1190, T1203
Suspicious Automator Workflows Execution elastic, medium T1059, T1059.007
Suspicious AWS S3 Connection via Script Interpreter elastic, medium T1059, T1059.002, T1059.006, T1059.007, T1102, T1567

T1106 Native API 3 rules

In-Memory JXA Execution via ScriptingAdditions elastic T1106, T1620
Reflective Binary Load elastic T1106, T1620
Reflective Dylib Load elastic T1106, T1620

T1129 Shared Modules 2 rules

Suspicious Dylib Load from Temporary Directory elastic T1129
Unusual Library Load via Python elastic, high T1059, T1059.006, T1129

T1203 Exploitation for Client Execution 2 rules

Potential JAVA/JNDI Exploitation Attempt elastic, high T1059, T1059.004, T1059.006, T1059.007, T1190, T1203
Suspicious Browser Child Process elastic, high T1059, T1059.001, T1059.002, T1059.004, T1059.006, T1105

T1204 User Execution 3 rules

macOS Gatekeeper User Override sigma, high T1204, T1553, T1553.001
macOS XProtect Malware Detection sigma, critical T1204
Suspicious Apple Mail Rule Plist Modification elastic, medium T1204, T1546, T1647

T1204.001 User Execution: Malicious Link 1 rule

VScode Extension Install via URI Handler elastic T1059, T1059.004, T1204, T1204.001

T1204.002 User Execution: Malicious File 4 rules

T1559 Inter-Process Communication 2 rules

File Cloned by Unsigned or Untrusted Process elastic T1559
macOS XPC Service Abuse sigma, medium T1559

T1559.003 Inter-Process Communication: XPC Services 2 rules

Suspicious XPC Service Child Process elastic T1059, T1059.004, T1559, T1559.003
Unsigned or Untrusted Application Launch via XPC elastic T1059, T1059.004, T1559, T1559.003

T1569.001 System Services: Launchctl 1 rule

Launch Service Creation and Immediate Loading elastic, low T1543, T1543.001, T1543.004, T1569, T1569.001

Persistence 42 rules, 25 techniques

(no specific technique) 1 rule

CrowdStrike MacOS plutil Novel Plist Modification panther

T1037 Boot or Logon Initialization Scripts 1 rule

Persistence via Folder Action Script elastic, medium T1037, T1059, T1546

T1037.002 Boot or Logon Initialization Scripts: Login Hook 3 rules

MacOS LoginHook Persistence splunk, medium T1037, T1037.002
Persistence via Login or Logout Hook elastic, medium T1037, T1037.002
Potential Persistence via Login Hook elastic, medium T1037, T1037.002, T1547, T1647

T1037.005 Boot or Logon Initialization Scripts: Startup Items 1 rule

Suspicious StartupItem Plist Creation elastic, high T1037, T1037.005

T1053.002 Scheduled Task/Job: At 1 rule

At Job Creation or Modification via Shell Command elastic T1053, T1053.002

T1053.003 Scheduled Task/Job: Cron 2 rules

Cron Tab Creation or Modification via Shell Command elastic T1053, T1053.003
Suspicious CronTab Creation or Modification elastic, medium T1053, T1053.003

T1078.003 Valid Accounts: Local Accounts 2 rules

Attempt to Enable the Root Account elastic, medium T1078, T1078.003
Potential Hidden Local User Account Creation elastic, medium T1078, T1078.003, T1136, T1136.001, T1564, T1564.002

T1098 Account Manipulation 1 rule

macOS User Account Manipulation sigma, high T1098, T1136, T1136.001

T1098.004 Account Manipulation: SSH Authorized Keys 1 rule

SSH Authorized Keys File Activity elastic, medium T1021, T1021.004, T1098, T1098.004, T1563, T1563.001

T1133 External Remote Services 1 rule

Remote SSH Login Enabled via systemsetup Command elastic, medium T1021, T1021.004, T1133

T1136 Create Account 1 rule

MacOS Account Created splunk, low T1136

T1136.001 Create Account: Local Account 2 rules

macOS User Account Manipulation sigma, high T1098, T1136, T1136.001
Potential Hidden Local User Account Creation elastic, medium T1078, T1078.003, T1136, T1136.001, T1564, T1564.002

T1176 Software Extensions 1 rule

OSQuery Detected Unwanted Chrome Extensions panther, medium T1176

T1543 Create or Modify System Process 3 rules

Finder Sync Plugin Registered and Enabled elastic, medium T1543
macOS ESF Launch Persistence Creation sigma, high T1543
MacOS Kextload Usage splunk, medium T1543

T1543.001 Create or Modify System Process: Launch Agent 9 rules

Creation of Hidden Launch Agent or Daemon elastic, medium T1543, T1543.001, T1543.004, T1564, T1564.001
First Time Python Created a LaunchAgent or LaunchDaemon elastic, medium T1543, T1543.001, T1543.004
Launch Service Creation and Immediate Loading elastic, low T1543, T1543.001, T1543.004, T1569, T1569.001
macOS LaunchAgent/LaunchDaemon Persistence sigma, medium T1543, T1543.001
Persistence via a Hidden Plist Filename elastic, high T1543, T1543.001, T1547, T1564, T1564.001, T1647
Persistence via a Masqueraded Plist Filename elastic T1036, T1036.005, T1543, T1543.001, T1547, T1647
Persistence via Suspicious Launch Agent or Launch Daemon elastic, high T1543, T1543.001, T1543.004, T1547, T1647
Suspicious Hidden Child Process of Launchd elastic, medium T1543, T1543.001, T1543.004, T1564, T1564.001
Unusual Launch Service Creation via Unsigned or Untrusted Binary elastic T1543, T1543.001, T1543.004, T1547, T1647

T1543.004 Create or Modify System Process: Launch Daemon 6 rules

T1546 Event Triggered Execution 3 rules

Persistence via Folder Action Script elastic, medium T1037, T1059, T1546
Python Path Configuration File (.pth) with Import Preface elastic T1059, T1059.006, T1546
Suspicious Apple Mail Rule Plist Modification elastic, medium T1204, T1546, T1647

T1546.002 Event Triggered Execution: Screensaver 1 rule

Unexpected Child Process of macOS Screensaver Engine elastic, medium T1546, T1546.002

T1546.004 Event Triggered Execution: Unix Shell Configuration Modification 1 rule

Bash Shell Profile Modification elastic, medium T1546, T1546.004

T1546.014 Event Triggered Execution: Emond 2 rules

Potential Persistence via Emond elastic T1546, T1546.014
Suspicious Emond Child Process elastic, medium T1059, T1059.001, T1059.002, T1059.004, T1059.006, T1546

T1546.016 Event Triggered Execution: Installer Packages 3 rules

Initial Access Staging via Installer Package elastic T1546, T1546.016
Suspicious File Creation via Pkg Install Script elastic, high T1059, T1059.004, T1546, T1546.016
Unsigned or Untrusted Process Execution via Installer elastic T1546, T1546.016

T1547 Boot or Logon Autostart Execution 7 rules

Dock Tile Plug-In Load elastic T1547
macOS Configuration Profile Installation sigma, medium T1547, T1556
Persistence via a Hidden Plist Filename elastic, high T1543, T1543.001, T1547, T1564, T1564.001, T1647
Persistence via a Masqueraded Plist Filename elastic T1036, T1036.005, T1543, T1543.001, T1547, T1647
Persistence via Suspicious Launch Agent or Launch Daemon elastic, high T1543, T1543.001, T1543.004, T1547, T1647
Potential Persistence via Login Hook elastic, medium T1037, T1037.002, T1547, T1647
Unusual Launch Service Creation via Unsigned or Untrusted Binary elastic T1543, T1543.001, T1543.004, T1547, T1647

T1547.006 Boot or Logon Autostart Execution: Kernel Modules and Extensions 2 rules

Attempt to Unload Elastic Endpoint Security Kernel Extension elastic, high T1547, T1547.006, T1685
Elastic Endpoint Security Kernel Extension Unload elastic T1547, T1547.006, T1685

T1547.015 Boot or Logon Autostart Execution: Login Items 1 rule

Creation of Hidden Login Item via Apple Script elastic, medium T1059, T1059.002, T1547, T1547.015, T1647

T1556 Modify Authentication Process 1 rule

macOS Configuration Profile Installation sigma, medium T1547, T1556

Privilege Escalation 24 rules, 15 techniques

T1037.002 Boot or Logon Initialization Scripts: Login Hook 1 rule

MacOS LoginHook Persistence splunk, medium T1037, T1037.002

T1053.003 Scheduled Task/Job: Cron 1 rule

Potential Privilege Escalation via Root Crontab File Modification elastic T1053, T1053.003

T1055 Process Injection 1 rule

Potential Code Injection via Remote Thread elastic T1055

T1068 Exploitation for Privilege Escalation 3 rules

macOS Setuid/Setgid Privilege Escalation sigma, high T1068, T1548, T1548.001
Potential Privilege Escalation via TCC bypass with fake TCC.db elastic T1068, T1548, T1548.006
Suspicious Child Process of Adobe Acrobat Reader Update Service elastic, high T1068

T1078 Valid Accounts 3 rules

Apple Scripting Execution with Administrator Privileges elastic, medium T1059, T1059.002, T1078, T1548, T1548.004
Execution with Explicit Credentials via Scripting elastic, medium T1059, T1059.001, T1059.002, T1059.004, T1059.006, T1078
macOS Sudo Privilege Escalation Attempts sigma, medium T1078, T1548, T1548.003

T1078.003 Valid Accounts: Local Accounts 3 rules

Attempt to Enable the Root Account elastic, medium T1078, T1078.003
Potential Admin Group Account Addition elastic, medium T1078, T1078.003, T1098, T1098.007
User Added to the Admin Group elastic, low T1078, T1078.003, T1098, T1098.007

T1098.007 Account Manipulation: Additional Local or Domain Groups 2 rules

Potential Admin Group Account Addition elastic, medium T1078, T1078.003, T1098, T1098.007
User Added to the Admin Group elastic, low T1078, T1078.003, T1098, T1098.007

T1484 Domain or Tenant Policy Modification 1 rule

macOS MDM Profile Manipulation sigma, high T1484

T1543 Create or Modify System Process 1 rule

MacOS Kextload Usage splunk, medium T1543

T1546.014 Event Triggered Execution: Emond 1 rule

Suspicious Emond Child Process elastic, medium T1059, T1059.001, T1059.002, T1059.004, T1059.006, T1546

T1548 Abuse Elevation Control Mechanism 3 rules

Execution via Electron Child Process Node.js Module elastic, medium T1059, T1059.007, T1548
macOS TCC Privacy Bypass Attempt sigma, high T1548
Potential Privacy Control Bypass via Localhost Secure Copy elastic, high T1005, T1548

T1548.001 Abuse Elevation Control Mechanism: Setuid and Setgid 1 rule

macOS Setuid/Setgid Privilege Escalation sigma, high T1068, T1548, T1548.001

T1548.003 Abuse Elevation Control Mechanism: Sudo and Sudo Caching 4 rules

macOS Multiple Failed Sudo Attempts sigma, high T1110, T1548, T1548.003
macOS Sudo Privilege Escalation Attempts sigma, medium T1078, T1548, T1548.003
Potential Privilege Escalation via Sudoers File Modification elastic, high T1548, T1548.003
Sudoers File Activity elastic, medium T1548, T1548.003

T1548.004 Abuse Elevation Control Mechanism: Elevated Execution with Prompt 2 rules

Apple Scripting Execution with Administrator Privileges elastic, medium T1059, T1059.002, T1078, T1548, T1548.004
Execution with Explicit Credentials via Scripting elastic, medium T1059, T1059.001, T1059.002, T1059.004, T1059.006, T1078

T1548.006 Abuse Elevation Control Mechanism: TCC Manipulation 4 rules

Potential Privacy Control Bypass via Localhost Secure Copy elastic T1548, T1548.006
Potential Privacy Control Bypass via TCCDB Modification elastic, medium T1548, T1548.006, T1685
Potential Privilege Escalation via TCC bypass with fake TCC.db elastic T1068, T1548, T1548.006
Suspicious TCC Access Granted for User Folders elastic, high T1005, T1548, T1548.006

Stealth 35 rules, 24 techniques

(no specific technique) 1 rule

macOS ESF Suspicious W+X Memory Mapping sigma, high

T1006 Direct Volume Access 1 rule

TCC Bypass via Mounted APFS Snapshot Access elastic, high T1005, T1006

T1027 Obfuscated Files or Information 3 rules

T1027.004 Obfuscated Files or Information: Compile After Delivery 1 rule

GenAI Process Compiling or Generating Executables elastic, medium T1027, T1027.004, T1587, T1587.001

T1027.010 Obfuscated Files or Information: Command Obfuscation 1 rule

Command Line Obfuscation via Whitespace Padding elastic, medium T1027, T1027.010, T1059, T1059.001, T1140

T1027.013 Obfuscated Files or Information: Encrypted/Encoded File 1 rule

ROT Encoded Python Script Execution elastic, medium T1027, T1027.013, T1059, T1059.006, T1140

T1027.015 Obfuscated Files or Information: Compression 1 rule

File Compressed or Archived into Common Format by Unsigned Process elastic, low T1027, T1027.015, T1074, T1074.001, T1132, T1132.001

T1036.005 Masquerading: Match Legitimate Resource Name or Location 1 rule

Persistence via a Masqueraded Plist Filename elastic T1036, T1036.005, T1543, T1543.001, T1547, T1647

T1036.006 Masquerading: Space after Filename 1 rule

Masquerading Space After Filename elastic, medium T1036, T1036.006, T1204, T1204.002

T1055 Process Injection 1 rule

Suspicious Task for Pid System Call elastic T1055

T1070 Indicator Removal 1 rule

MacOS Log Removal splunk, medium T1070

T1070.004 Indicator Removal: File Deletion 3 rules

macOS Data Destruction Tools sigma, high T1070, T1070.004, T1485
macOS ESF Deletion In Sensitive Directories sigma, medium T1070.004
WebServer Access Logs Deleted elastic, medium T1070, T1070.004

T1078.003 Valid Accounts: Local Accounts 1 rule

Potential Hidden Local User Account Creation elastic, medium T1078, T1078.003, T1136, T1136.001, T1564, T1564.002

T1140 Deobfuscate/Decode Files or Information 5 rules

Command Line Obfuscation via Whitespace Padding elastic, medium T1027, T1027.010, T1059, T1059.001, T1140
Execution via OpenClaw Agent elastic, medium T1059, T1059.001, T1059.002, T1059.003, T1059.004, T1059.006
Long Base64 Encoded Command via Scripting Interpreter elastic, high T1027, T1059, T1059.001, T1059.006, T1059.007, T1140
ROT Encoded Python Script Execution elastic, medium T1027, T1027.013, T1059, T1059.006, T1140
Suspicious OpenSSL Execution via macOS Application elastic T1027, T1059, T1059.004, T1140, T1204, T1204.002

T1211 Exploitation for Stealth 1 rule

MacOS Hidden File Mounted elastic T1059, T1059.004, T1211

T1218.011 System Binary Proxy Execution: Rundll32 1 rule

Execution via OpenClaw Agent elastic, medium T1059, T1059.001, T1059.002, T1059.003, T1059.004, T1059.006

T1497.001 Virtualization/Sandbox Evasion: System Checks 1 rule

Virtual Machine Fingerprinting via Grep elastic, medium T1082, T1497, T1497.001

T1564.001 Hide Artifacts: Hidden Files and Directories 8 rules

Creation of Hidden Launch Agent or Daemon elastic, medium T1543, T1543.001, T1543.004, T1564, T1564.001
Execution of Hidden File from the Shared Directory elastic T1564, T1564.001
Hidden Files and Directories via Hidden Flag elastic, medium T1564, T1564.001
macOS ESF Rename To Hidden Dotfile sigma, medium T1564.001
MacOS Hidden Files and Directories splunk, low T1564, T1564.001
Persistence via a Hidden Plist Filename elastic, high T1543, T1543.001, T1547, T1564, T1564.001, T1647
Suspicious Hidden Child Process of Launchd elastic, medium T1543, T1543.001, T1543.004, T1564, T1564.001
Suspicious Perl File Modification elastic T1059, T1059.004, T1564, T1564.001

T1564.002 Hide Artifacts: Hidden Users 1 rule

Potential Hidden Local User Account Creation elastic, medium T1078, T1078.003, T1136, T1136.001, T1564, T1564.002

T1564.003 Hide Artifacts: Hidden Window 1 rule

Nohup Execution followed by Outbound Network Connection elastic T1059, T1059.004, T1564, T1564.003

T1574 Hijack Execution Flow 2 rules

Dylib Load via SSH-Keygen elastic T1574
Unusual Dylib Load from Users Shared Directory elastic T1574

T1574.006 Hijack Execution Flow: Dynamic Linker Hijacking 1 rule

Modification of Environment Variable via Unsigned or Untrusted Parent elastic, medium T1574, T1574.006, T1574.007

T1574.007 Hijack Execution Flow: Path Interception by PATH Environment Variable 1 rule

Modification of Environment Variable via Unsigned or Untrusted Parent elastic, medium T1574, T1574.006, T1574.007

T1620 Reflective Code Loading 3 rules

In-Memory JXA Execution via ScriptingAdditions elastic T1106, T1620
Reflective Binary Load elastic T1106, T1620
Reflective Dylib Load elastic T1106, T1620

Defense Impairment 35 rules, 9 techniques

T1222 File and Directory Permissions Modification 2 rules

macOS Code Signature Invalidation sigma, critical T1222, T1553, T1553.002
macOS TCC Database Modification sigma, critical T1222, T1685

T1484 Domain or Tenant Policy Modification 1 rule

macOS MDM Profile Manipulation sigma, high T1484

T1553 Subvert Trust Controls 1 rule

Suspicious Stop of TCCD via Launchctl elastic T1553

T1553.001 Subvert Trust Controls: Gatekeeper Bypass 7 rules

Attempt to Disable Gatekeeper elastic, medium T1553, T1553.001
Gatekeeper Override and Execution elastic, high T1204, T1204.002, T1553, T1553.001, T1685
MacOS Gatekeeper Bypass splunk, low T1553, T1553.001
macOS Gatekeeper User Override sigma, high T1204, T1553, T1553.001
Potential Payload Download via AppleScript Applet elastic T1105, T1553, T1553.001
Quarantine Attrib Removed by Unsigned or Untrusted Process elastic, medium T1553, T1553.001, T1685
Quarantine Attribute Removal via TextEdit elastic T1553, T1553.001, T1685

T1553.002 Subvert Trust Controls: Code Signing 1 rule

macOS Code Signature Invalidation sigma, critical T1222, T1553, T1553.002

T1553.004 Subvert Trust Controls: Install Root Certificate 1 rule

Attempt to Install Root Certificate elastic, medium T1553, T1553.004

T1647 Plist File Modification 11 rules

Creation of Hidden Login Item via Apple Script elastic, medium T1059, T1059.002, T1547, T1547.015, T1647
CrowdStrike MacOS plutil Novel Plist Modification (Anomaly Detection) panther, medium T1647
MacOS plutil splunk, medium T1647
Modification of Safari Settings via Defaults Command elastic, medium T1647, T1685
Persistence via a Hidden Plist Filename elastic, high T1543, T1543.001, T1547, T1564, T1564.001, T1647
Persistence via a Masqueraded Plist Filename elastic T1036, T1036.005, T1543, T1543.001, T1547, T1647
Persistence via Suspicious Launch Agent or Launch Daemon elastic, high T1543, T1543.001, T1543.004, T1547, T1647
Potential Persistence via Login Hook elastic, medium T1037, T1037.002, T1547, T1647
SoftwareUpdate Preferences Modification elastic, medium T1647, T1685
Suspicious Apple Mail Rule Plist Modification elastic, medium T1204, T1546, T1647
Unusual Launch Service Creation via Unsigned or Untrusted Binary elastic T1543, T1543.001, T1543.004, T1547, T1647

T1685 Disable or Modify Tools 18 rules

Attempt to Unload Elastic Endpoint Security Kernel Extension elastic, high T1547, T1547.006, T1685
Elastic Agent Service Terminated elastic, medium T1489, T1685
Elastic Endpoint Security Kernel Extension Unload elastic T1547, T1547.006, T1685
Firewall Disabled sigma, high T1685, T1686
Gatekeeper Override and Execution elastic, high T1204, T1204.002, T1553, T1553.001, T1685
GenAI CLI Started with Unsafe Permission Bypass elastic, medium T1685
MacOS ALF is misconfigured panther, high T1685
macOS System Integrity Protection Modification Attempt sigma, critical T1685
macOS TCC Database Modification sigma, critical T1222, T1685
Modification of Safari Settings via Defaults Command elastic, medium T1647, T1685
Modification of Safari Settings via Defaults Command elastic T1685
Operating System Security Updates Disabled elastic T1685
OSQuery Reports Application Firewall Disabled panther, medium T1685
Potential Privacy Control Bypass via TCCDB Modification elastic, medium T1548, T1548.006, T1685
Quarantine Attrib Removed by Unsigned or Untrusted Process elastic, medium T1553, T1553.001, T1685
Quarantine Attribute Removal via TextEdit elastic T1553, T1553.001, T1685
SoftwareUpdate Preferences Modification elastic, medium T1647, T1685
Suspicious Unload of Elastic Agent via Launchctl elastic T1685

T1686 Disable or Modify System Firewall 1 rule

Firewall Disabled sigma, high T1685, T1686

Credential Access 19 rules, 11 techniques

T1003 OS Credential Dumping 4 rules

Credential Access via TruffleHog Execution elastic, medium T1003, T1005, T1552, T1552.001, T1555
Dumping Account Hashes via Built-In Commands elastic T1003
Kerberos Cached Credentials Dumping elastic, high T1003, T1558, T1558.003, T1558.005
Potential Secret Scanning via Gitleaks elastic, medium T1003, T1213, T1213.003, T1552, T1552.001, T1555

T1003.008 OS Credential Dumping: /etc/passwd and /etc/shadow 1 rule

Dumping Account Hashes via Built-In Commands elastic, high T1003, T1003.008

T1110 Brute Force 2 rules

macOS Multiple Failed Sudo Attempts sigma, high T1110, T1548, T1548.003
Potential macOS SSH Brute Force Detected elastic, medium T1110, T1133

T1528 Steal Application Access Token 1 rule

Multi-Cloud CLI Token and Credential Access Commands elastic, high T1528, T1552, T1552.001

T1539 Steal Web Session Cookie 1 rule

Potential Cookies Theft via Browser Debugging elastic, medium T1539

T1552.001 Unsecured Credentials: Credentials In Files 5 rules

Credential Access via TruffleHog Execution elastic, medium T1003, T1005, T1552, T1552.001, T1555
Multi-Cloud CLI Token and Credential Access Commands elastic, high T1528, T1552, T1552.001
Potential Credential Discovery via Recursive Grep elastic, high T1083, T1552, T1552.001
Potential Kerberos Attack via Bifrost elastic, high T1550, T1550.002, T1550.003, T1552, T1552.001, T1558
Potential Secret Scanning via Gitleaks elastic, medium T1003, T1213, T1213.003, T1552, T1552.001, T1555

T1552.005 Unsecured Credentials: Cloud Instance Metadata API 2 rules

Cloud Instance Metadata Credential Path HTTP Request elastic, medium T1552, T1552.005
Suspicious Instance Metadata Service (IMDS) API Command Line Execution elastic, medium T1016, T1082, T1552, T1552.005, T1580

T1555 Credentials from Password Stores 3 rules

Credential Access via TruffleHog Execution elastic, medium T1003, T1005, T1552, T1552.001, T1555
macOS Authentication Events sigma, low T1078, T1555
Potential Secret Scanning via Gitleaks elastic, medium T1003, T1213, T1213.003, T1552, T1552.001, T1555

T1555.001 Credentials from Password Stores: Keychain 4 rules

Dumping of Keychain Content via Security Command elastic, high T1555, T1555.001
MacOS Keychains Dumped splunk, medium T1555, T1555.001
macOS Suspicious Keychain Access sigma, high T1555, T1555.001
SystemKey Access via Command Line elastic, high T1005, T1555, T1555.001

T1558.003 Steal or Forge Kerberos Tickets: Kerberoasting 3 rules

Kerberos Cached Credentials Dumping elastic, high T1003, T1558, T1558.003, T1558.005
Potential Kerberos Attack via Bifrost elastic, high T1550, T1550.002, T1550.003, T1552, T1552.001, T1558
Potential Kerberos Attack via Bifrost elastic T1550, T1550.003, T1558, T1558.003

T1558.005 Steal or Forge Kerberos Tickets: Ccache Files 2 rules

Kerberos Cached Credentials Dumping elastic, high T1003, T1558, T1558.003, T1558.005
Potential Kerberos Attack via Bifrost elastic, high T1550, T1550.002, T1550.003, T1552, T1552.001, T1558

Discovery 10 rules, 14 techniques

(no specific technique) 1 rule

macOS ESF Sensitive File Access sigma, high

T1016 System Network Configuration Discovery 2 rules

MacOS List Firewall Rules splunk, low T1016
Suspicious Instance Metadata Service (IMDS) API Command Line Execution elastic, medium T1016, T1082, T1552, T1552.005, T1580

T1016.001 System Network Configuration Discovery: Internet Connection Discovery 1 rule

DNS Request for IP Lookup Service via Unsigned Binary elastic, medium T1016, T1016.001

T1046 Network Service Discovery 1 rule

Suricata and Elastic Defend Network Correlation elastic, medium T1046, T1071, T1571

T1069.001 Permission Groups Discovery: Local Groups 1 rule

Enumeration of Users or Groups via Built-in Commands elastic, low T1069, T1069.001, T1069.002, T1087, T1087.001, T1087.002

T1069.002 Permission Groups Discovery: Domain Groups 1 rule

Enumeration of Users or Groups via Built-in Commands elastic, low T1069, T1069.001, T1069.002, T1087, T1087.001, T1087.002

T1082 System Information Discovery 2 rules

Suspicious Instance Metadata Service (IMDS) API Command Line Execution elastic, medium T1016, T1082, T1552, T1552.005, T1580
Virtual Machine Fingerprinting via Grep elastic, medium T1082, T1497, T1497.001

T1083 File and Directory Discovery 1 rule

Potential Credential Discovery via Recursive Grep elastic, high T1083, T1552, T1552.001

T1087.001 Account Discovery: Local Account 1 rule

Enumeration of Users or Groups via Built-in Commands elastic, low T1069, T1069.001, T1069.002, T1087, T1087.001, T1087.002

T1087.002 Account Discovery: Domain Account 1 rule

Enumeration of Users or Groups via Built-in Commands elastic, low T1069, T1069.001, T1069.002, T1087, T1087.001, T1087.002

T1135 Network Share Discovery 1 rule

MacOS Network Share Discovery splunk, low T1135

T1497.001 Virtualization/Sandbox Evasion: System Checks 1 rule

Virtual Machine Fingerprinting via Grep elastic, medium T1082, T1497, T1497.001

T1518.001 Software Discovery: Security Software Discovery 1 rule

Security Software Discovery via Grep elastic, medium T1518, T1518.001

T1580 Cloud Infrastructure Discovery 1 rule

Suspicious Instance Metadata Service (IMDS) API Command Line Execution elastic, medium T1016, T1082, T1552, T1552.005, T1580

Lateral Movement 12 rules, 10 techniques

T1021 Remote Services 2 rules

macOS Remote Execution Tools sigma, low T1021, T1563
Virtual Private Network Connection Attempt elastic, low T1021, T1133

T1021.002 Remote Services: SMB/Windows Admin Shares 2 rules

Attempt to Mount SMB Share via Command Line elastic, low T1021, T1021.002
macOS Network Share Access sigma, medium T1021, T1021.002, T1039

T1021.004 Remote Services: SSH 4 rules

macOS File Transfer Tool Execution sigma, medium T1021, T1021.004, T1570
macOS SSH Connection Detection sigma, medium T1021, T1021.004, T1078, T1078.004
Remote SSH Login Enabled via systemsetup Command elastic, medium T1021, T1021.004, T1133
SSH Authorized Keys File Activity elastic, medium T1021, T1021.004, T1098, T1098.004, T1563, T1563.001

T1021.005 Remote Services: VNC 1 rule

macOS Screen Sharing Session sigma, medium T1021, T1021.005, T1563

T1091 Replication Through Removable Media 1 rule

New USB Storage Device Mounted elastic, low T1052, T1052.001, T1091

T1550.002 Use Alternate Authentication Material: Pass the Hash 1 rule

Potential Kerberos Attack via Bifrost elastic, high T1550, T1550.002, T1550.003, T1552, T1552.001, T1558

T1550.003 Use Alternate Authentication Material: Pass the Ticket 2 rules

Potential Kerberos Attack via Bifrost elastic, high T1550, T1550.002, T1550.003, T1552, T1552.001, T1558
Potential Kerberos Attack via Bifrost elastic T1550, T1550.003, T1558, T1558.003

T1563 Remote Service Session Hijacking 2 rules

macOS Remote Execution Tools sigma, low T1021, T1563
macOS Screen Sharing Session sigma, medium T1021, T1021.005, T1563

T1563.001 Remote Service Session Hijacking: SSH Hijacking 1 rule

SSH Authorized Keys File Activity elastic, medium T1021, T1021.004, T1098, T1098.004, T1563, T1563.001

T1570 Lateral Tool Transfer 1 rule

macOS File Transfer Tool Execution sigma, medium T1021, T1021.004, T1570

Collection 13 rules, 7 techniques

T1005 Data from Local System 7 rules

Credential Access via TruffleHog Execution elastic, medium T1003, T1005, T1552, T1552.001, T1555
LLM-Based Curl Activity Triage elastic, medium T1005, T1048, T1105
LLM-Based Wget Activity Triage elastic, medium T1005, T1048, T1105
Potential Privacy Control Bypass via Localhost Secure Copy elastic, high T1005, T1548
Suspicious TCC Access Granted for User Folders elastic, high T1005, T1548, T1548.006
SystemKey Access via Command Line elastic, high T1005, T1555, T1555.001
TCC Bypass via Mounted APFS Snapshot Access elastic, high T1005, T1006

T1039 Data from Network Shared Drive 1 rule

macOS Network Share Access sigma, medium T1021, T1021.002, T1039

T1056 Input Capture 1 rule

MacOS Keyboard Events panther, medium T1056

T1074.001 Data Staged: Local Data Staging 1 rule

File Compressed or Archived into Common Format by Unsigned Process elastic, low T1027, T1027.015, T1074, T1074.001, T1132, T1132.001

T1213.003 Data from Information Repositories: Code Repositories 1 rule

Potential Secret Scanning via Gitleaks elastic, medium T1003, T1213, T1213.003, T1552, T1552.001, T1555

T1560.001 Archive Collected Data: Archive via Utility 3 rules

File Compressed or Archived into Common Format by Unsigned Process elastic, low T1027, T1027.015, T1074, T1074.001, T1132, T1132.001
GenAI Process Performing Encoding/Chunking Prior to Network Activity elastic, medium T1027, T1030, T1560, T1560.001, T1560.002
macOS Data Compression Tools sigma, low T1560, T1560.001

T1560.002 Archive Collected Data: Archive via Library 1 rule

GenAI Process Performing Encoding/Chunking Prior to Network Activity elastic, medium T1027, T1030, T1560, T1560.001, T1560.002

Command & Control 36 rules, 16 techniques

(no specific technique) 1 rule

macOS ESF Suspicious Curl Download sigma, medium

T1071 Application Layer Protocol 5 rules

Apple Script Execution followed by Network Connection elastic, medium T1059, T1059.002, T1071, T1105
macOS Network Utility Tools for C2 sigma, high T1059, T1071
PANW and Elastic Defend - Command and Control Correlation elastic, medium T1071
Possible JAVA Reverse Shell elastic T1059, T1071
Suricata and Elastic Defend Network Correlation elastic, medium T1046, T1071, T1571

T1071.001 Application Layer Protocol: Web Protocols 8 rules

Execution via OpenClaw Agent elastic, medium T1059, T1059.001, T1059.002, T1059.003, T1059.004, T1059.006
GenAI Process Connection to Unusual Domain elastic, medium T1071, T1071.001
macOS HTTP Tools with Protocol Indicators sigma, low T1071, T1071.001, T1105
Suspicious Curl to Google App Script Endpoint elastic, high T1071, T1071.001, T1102, T1102.002, T1105
Suspicious URL as argument to Self-Signed Binary elastic T1071, T1071.001, T1105
Unusual Network Connection to Suspicious Top Level Domain elastic, medium T1071, T1071.001
Unusual Network Connection to Suspicious Web Service elastic, medium T1071, T1071.001, T1102, T1567, T1567.002, T1567.003
URL as Process Argument via Installer Package elastic T1071, T1071.001, T1105

T1071.004 Application Layer Protocol: DNS 3 rules

GenAI Process Connection to Suspicious Top Level Domain elastic, medium T1071, T1071.004
macOS DNS Query Tools for C2 sigma, medium T1071, T1071.004, T1568
Uncommon DNS Request via Bun or Node.js elastic, low T1071, T1071.004, T1102

T1090 Proxy 3 rules

FortiGate SOCKS Traffic from an Unusual Process elastic, medium T1090
Potential Traffic Tunneling using QEMU elastic, medium T1090, T1219, T1572
Potential Tunneling via Tailscaled elastic, medium T1090, T1219, T1572

T1095 Non-Application Layer Protocol 1 rule

Potential Reverse Shell Activity via Terminal elastic, high T1059, T1095

T1102 Web Service 3 rules

Suspicious AWS S3 Connection via Script Interpreter elastic, medium T1059, T1059.002, T1059.006, T1059.007, T1102, T1567
Uncommon DNS Request via Bun or Node.js elastic, low T1071, T1071.004, T1102
Unusual Network Connection to Suspicious Web Service elastic, medium T1071, T1071.001, T1102, T1567, T1567.002, T1567.003

T1102.001 Web Service: Dead Drop Resolver 1 rule

Google Calendar C2 via Script Interpreter elastic, high T1059, T1059.002, T1059.006, T1059.007, T1102, T1102.001

T1102.002 Web Service: Bidirectional Communication 4 rules

Connection to Common Large Language Model Endpoints elastic, medium T1102, T1102.002
Google Calendar C2 via Script Interpreter elastic, high T1059, T1059.002, T1059.006, T1059.007, T1102, T1102.001
Potential VScode Remote Tunnel Established elastic T1102, T1102.002
Suspicious Curl to Google App Script Endpoint elastic, high T1071, T1071.001, T1102, T1102.002, T1105

T1105 Ingress Tool Transfer 15 rules

Apple Script Execution followed by Network Connection elastic, medium T1059, T1059.002, T1071, T1105
Curl Execution via Apple Installer Package elastic T1105
Curl Execution via Automator Application elastic T1105
Curl Execution via Env Binary elastic T1105
Executable File Access or Modification via Osascript elastic T1059, T1059.002, T1105
Execution via OpenClaw Agent elastic, medium T1059, T1059.001, T1059.002, T1059.003, T1059.004, T1059.006
LLM-Based Curl Activity Triage elastic, medium T1005, T1048, T1105
LLM-Based Wget Activity Triage elastic, medium T1005, T1048, T1105
macOS HTTP Tools with Protocol Indicators sigma, low T1071, T1071.001, T1105
Ollama DNS Query to Untrusted Domain elastic, low T1105, T1195, T1195.001, T1195.002
Potential Payload Download via AppleScript Applet elastic T1105, T1553, T1553.001
Suspicious Browser Child Process elastic, high T1059, T1059.001, T1059.002, T1059.004, T1059.006, T1105
Suspicious Curl to Google App Script Endpoint elastic, high T1071, T1071.001, T1102, T1102.002, T1105
Suspicious URL as argument to Self-Signed Binary elastic T1071, T1071.001, T1105
URL as Process Argument via Installer Package elastic T1071, T1071.001, T1105

T1132.001 Data Encoding: Standard Encoding 1 rule

File Compressed or Archived into Common Format by Unsigned Process elastic, low T1027, T1027.015, T1074, T1074.001, T1132, T1132.001

T1219 Remote Access Tools 2 rules

Potential Traffic Tunneling using QEMU elastic, medium T1090, T1219, T1572
Potential Tunneling via Tailscaled elastic, medium T1090, T1219, T1572

T1568 Dynamic Resolution 1 rule

macOS DNS Query Tools for C2 sigma, medium T1071, T1071.004, T1568

T1568.002 Dynamic Resolution: Domain Generation Algorithms 1 rule

DNS Resolution Failure Spike sigma, medium T1568, T1568.002

T1571 Non-Standard Port 1 rule

Suricata and Elastic Defend Network Correlation elastic, medium T1046, T1071, T1571

T1572 Protocol Tunneling 2 rules

Potential Traffic Tunneling using QEMU elastic, medium T1090, T1219, T1572
Potential Tunneling via Tailscaled elastic, medium T1090, T1219, T1572

Exfiltration 9 rules, 9 techniques

T1030 Data Transfer Size Limits 2 rules

GenAI Process Performing Encoding/Chunking Prior to Network Activity elastic, medium T1027, T1030, T1560, T1560.001, T1560.002
MacOS Data Chunking splunk, low T1030

T1041 Exfiltration Over C2 Channel 1 rule

macOS Network Upload Activity sigma, medium T1041, T1567

T1048 Exfiltration Over Alternative Protocol 2 rules

LLM-Based Curl Activity Triage elastic, medium T1005, T1048, T1105
LLM-Based Wget Activity Triage elastic, medium T1005, T1048, T1105

T1052.001 Exfiltration Over Physical Medium: Exfiltration over USB 1 rule

New USB Storage Device Mounted elastic, low T1052, T1052.001, T1091

T1537 Transfer Data to Cloud Account 1 rule

macOS Cloud Storage Access Tools sigma, medium T1537, T1567, T1567.002

T1567 Exfiltration Over Web Service 1 rule

macOS Network Upload Activity sigma, medium T1041, T1567

T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage 3 rules

macOS Cloud Storage Access Tools sigma, medium T1537, T1567, T1567.002
Suspicious AWS S3 Connection via Script Interpreter elastic, medium T1059, T1059.002, T1059.006, T1059.007, T1102, T1567
Unusual Network Connection to Suspicious Web Service elastic, medium T1071, T1071.001, T1102, T1567, T1567.002, T1567.003

T1567.003 Exfiltration Over Web Service: Exfiltration to Text Storage Sites 1 rule

Unusual Network Connection to Suspicious Web Service elastic, medium T1071, T1071.001, T1102, T1567, T1567.002, T1567.003

T1567.004 Exfiltration Over Web Service: Exfiltration Over Webhook 1 rule

Unusual Network Connection to Suspicious Web Service elastic, medium T1071, T1071.001, T1102, T1567, T1567.002, T1567.003

Impact 5 rules, 5 techniques

T1485 Data Destruction 1 rule

macOS Data Destruction Tools sigma, high T1070, T1070.004, T1485

T1486 Data Encrypted for Impact 1 rule

macOS Encryption Tool Usage sigma, medium T1486, T1565, T1565.001

T1489 Service Stop 2 rules

Elastic Agent Service Terminated elastic, medium T1489, T1685
macOS Service Disruption Activity sigma, medium T1489, T1529

T1529 System Shutdown/Reboot 1 rule

macOS Service Disruption Activity sigma, medium T1489, T1529

T1565.001 Data Manipulation: Stored Data Manipulation 2 rules

Hosts File Modified elastic, medium T1565, T1565.001
macOS Encryption Tool Usage sigma, medium T1486, T1565, T1565.001

(no MITRE mapping) 7 rules, 1 technique

(no MITRE mapping) 7 rules

External Alerts elastic, medium
macOS ULS Gatekeeper Block (spctl) sigma, high
macOS ULS Potential TCC Bypass Indicators sigma, medium
macOS ULS Quarantine or XProtect Detection sigma, high
macOS ULS securityd CodeSignature Failure sigma, medium
macOS ULS Sudo Execution Logged sigma, low
macOS ULS TCC Access Denied sigma, medium