322 detection rules reference this event. View event page.Sigma (71)
- Atomic MacOS Stealer - FileGrabber Activity severity high T1059, T1059.002
- Axios NPM Compromise Indicators - macOS severity high T1059, T1059.002, T1059.004, T1105, T1195, T1195.002
- Binary Padding - MacOS severity high T1027, T1027.001
- Clipboard Access Via OSAScript severity medium T1059, T1059.002, T1115
- Clipboard Data Collection Via Pbpaste severity medium T1115
- Creation Of A Local User Account severity low T1136, T1136.001
- Credentials from Password Stores - Keychain severity medium T1555, T1555.001
- Credentials In Files severity high T1552, T1552.001
- Decode Base64 Encoded Text -MacOs severity low T1027
- Disable Security Tools severity medium T1685
- Disk Image Creation Via Hdiutil - MacOS severity medium
- Disk Image Mounting Via Hdiutil - MacOS severity medium T1560, T1560.001, T1566, T1566.001
- File and Directory Discovery - MacOS severity informational T1083
- File Download Via Nscurl - MacOS severity medium T1105
- File Time Attribute Change severity medium T1070, T1070.006
- Gatekeeper Bypass via Xattr severity low T1553, T1553.001
- Guest Account Enabled Via Sysadminctl severity low T1078, T1078.001
- GUI Input Capture - macOS severity low T1056, T1056.002
- Hidden Flag Set On File/Directory Via Chflags - MacOS severity medium T1105, T1218, T1552, T1552.001, T1564, T1564.004
- Hidden User Creation severity medium T1564, T1564.002
- Indicator Removal on Host - Clear Mac System Logs severity medium T1685, T1685.006
- JAMF MDM Execution severity low
- JAMF MDM Potential Suspicious Child Process severity medium
- JXA In-memory Execution Via OSAScript severity high T1059, T1059.002, T1059.007
- Launch Agent/Daemon Execution Via Launchctl severity medium T1543, T1543.001, T1543.004, T1569, T1569.001
- Local Groups Discovery - MacOs severity informational T1069, T1069.001
- Local System Accounts Discovery - MacOs severity low T1087, T1087.001
- macOS ESF Suspicious Process Execution severity medium
- MacOS Network Service Scanning severity low T1046
- Macos Remote System Discovery severity informational T1018
- MacOS Scripting Interpreter AppleScript severity medium T1059, T1059.002
- Network Sniffing - MacOs severity informational T1040
- New File Exclusion Added To Time Machine Via Tmutil - MacOS severity medium T1490
- Osacompile Execution By Potentially Suspicious Applet/Osascript severity medium T1059, T1059.002
- OSACompile Run-Only Execution severity high T1059, T1059.002
- Payload Decoded and Decrypted via Built-in Utilities severity medium T1059, T1140, T1204
- Potential Base64 Decoded From Images severity high T1140
- Potential Discovery Activity Using Find - MacOS severity medium T1083
- Potential In-Memory Download And Compile Of Payloads severity medium T1059, T1059.007, T1105
- Potential Persistence Via PlistBuddy severity high T1543, T1543.001, T1543.004
- Potential WizardUpdate Malware Infection severity high
- Potential XCSSET Malware Infection severity medium
- Remote Access Tool - Potential MeshAgent Execution - MacOS severity medium T1219, T1219.002
- Remote Access Tool - Renamed MeshAgent Execution - MacOS severity high T1036, T1036.003, T1219, T1219.002
- Remote Access Tool - Team Viewer Session Started On MacOS Host severity low T1133
- Root Account Enable Via Dsenableroot severity medium T1078, T1078.001, T1078.003
- Scheduled Cron Task/Job - MacOs severity medium T1053, T1053.003
- Screen Capture - macOS severity low T1113
- Security Software Discovery - MacOs severity medium T1518, T1518.001
- Space After Filename - macOS severity low T1036, T1036.006
- Split A File Into Pieces severity low T1030
- Suspicious Browser Child Process - MacOS severity medium T1059, T1189, T1203
- Suspicious Execution via macOS Script Editor severity medium T1059, T1059.002, T1204, T1204.001, T1553, T1566
- Suspicious History File Operations severity medium T1552, T1552.003
- Suspicious Installer Package Child Process severity medium T1059, T1059.007, T1071, T1071.001
- Suspicious MacOS Firmware Activity severity medium
- Suspicious Microsoft Office Child Process - MacOS severity high T1059, T1059.002, T1137, T1137.002, T1204, T1204.002
- System Information Discovery Using Ioreg severity medium T1082
- System Information Discovery Using sw_vers severity medium T1082
- System Information Discovery Using System_Profiler severity medium T1082, T1497, T1497.001
- System Information Discovery Via Sysctl - MacOS severity medium T1082, T1497, T1497.001
- System Integrity Protection (SIP) Disabled severity medium T1518, T1518.001
- System Integrity Protection (SIP) Enumeration severity low T1518, T1518.001
- System Network Connections Discovery - MacOs severity informational T1049
- System Network Discovery - macOS severity informational T1016
- System Shutdown/Reboot - MacOs severity informational T1529
- Time Machine Backup Deletion Attempt Via Tmutil - MacOS severity medium T1490
- Time Machine Backup Disabled Via Tmutil - MacOS severity medium T1490
- User Added To Admin Group Via Dscl severity medium T1078, T1078.003
- User Added To Admin Group Via DseditGroup severity medium T1078, T1078.003
- User Added To Admin Group Via Sysadminctl severity medium T1078, T1078.003
Elastic (251)
- Abnormally Large Javascript Evaluation via Nodejs T1059, T1059.007
- Abnormally Large Shell Script Execution via Perl T1059, T1059.004
- Account or Group Discovery via Built-In Tools severity low building block T1069, T1069.001, T1069.002, T1087, T1087.001, T1087.002
- AppleScript Decoded via Base64 T1027, T1059, T1059.002, T1140
- Arbitrary Python Code Execution via Nodejs T1059, T1059.006
- Attempt to establish VScode Remote Tunnel T1059, T1059.001, T1059.003, T1059.004, T1102, T1102.002
- AWS SSM `SendCommand` with Run Shell Command Parameters severity medium T1059, T1059.001, T1059.004, T1651
- AWS SSM Session Manager Child Process Execution severity medium T1059, T1059.001, T1059.004, T1651
- Background Process Execution via Shell T1059, T1059.004
- Base64 Encoded String Execution via Osascript T1027, T1059, T1059.002, T1140
- Clipboard accessed by Unsigned or Untrusted Binary T1115
- Cocoa Applet Binary Execution T1059, T1059.002
- Code Editor Untrusted or Unsigned Child Process Execution T1059, T1059.004
- Command Execution via Screen Session T1059, T1059.004
- Crypto Wallet File Access via CommandLine T1552, T1552.001
- Curl Download and Execution of JavaScript Payload T1059, T1059.007
- Curl Download and OsaScript Payload Execution via Node T1105
- Curl Execution via Application Shell Script T1105
- Curl Execution via CommandLine Shell Script T1105
- Curl Execution via Shell Profile severity high T1059, T1059.004, T1105, T1546, T1546.004
- Curl Hidden Binary Modification via Osascript T1059, T1059.002, T1105
- Curl Local File Read or Write via Osascript T1105
- Curl or Wget Spawned via Node.js severity medium T1071, T1071.001, T1105
- Curl Output Piped to Osascript T1059, T1059.002, T1105
- Curl to FTP Server via Raw IP T1105
- Curl to Telegram API T1071, T1071.001
- Cursor Arbitrary Code Execution via PHP T1059, T1059.004, T1195, T1195.001
- DARKRADIATION Ransomware Infection T1486
- Data Encrypted and Archived T1027, T1027.013, T1074, T1074.001
- Data Encrypted via OpenSSL Utility severity low T1027, T1027.013, T1074, T1074.001
- Decoded or Decrypted Payload Written to Suspicious Directory T1027, T1059, T1059.004, T1140, T1204, T1204.002
- Decoy Document Creation via Curl T1204, T1204.002
- Decoy file Open via Preview App T1036, T1204, T1204.002
- Default Application Hijacking T1574
- Discovery Command Output Written to Suspicious File severity medium T1016, T1033, T1074, T1074.001, T1082
- Discovery of GitHub Actions Runner Process PID T1057, T1059, T1195, T1195.001
- Disk Image Download and Mount via Hdiutil T1059, T1105, T1204, T1204.002, T1218
- Disown Execution via Shell Command from Volume Mount T1059, T1059.004
- Dscl Execution via Osascript T1033, T1059, T1059.002
- Dylib Injection via Process Environment Variables severity high T1574, T1574.006
- Dylib Loaded by Process in Suspicious Location T1574
- Egress Network Connection from Node.js Descendant T1059, T1059.004, T1071, T1071.001
- Elevated Apple Script Execution via Unsigned Parent T1059, T1548
- Embedded Payload Dropped and Executed T1027, T1027.009
- Empire Stager Execution T1059, T1059.004, T1059.006, T1132, T1132.001
- Environment Variable Secret Collection T1074, T1074.001, T1119
- ExecuteWithPrivileges Prompt via Unsigned or Untrusted Application T1548, T1548.004
- Execution of a File Dropped by OpenSSL T1027, T1140, T1204, T1204.002
- Execution of Javascript Payload via Osascript T1059, T1059.007
- Execution of JavaScript Payload via Python T1059, T1059.007
- Execution of Non-Executable File via Shell T1036, T1059, T1059.004
- Execution of Self-Signed Binary from Volume Mount T1059, T1059.004
- Execution via Electron Child Process Node.js Module T1059, T1059.007, T1548
- Execution via GitHub Actions Runner severity medium T1059, T1059.001, T1059.002, T1059.003, T1059.004, T1059.006
- Exfiltration Data Staging in Temporary Directory via Osascript T1119
- External IP Address Discovery via Curl severity low T1016, T1016.001
- File Download Piped to Script Interpreter T1059
- File hidden via Chflags T1564, T1564.001
- File Hidden via SetFile T1564, T1564.001
- File Made Executable via Package Install Script T1222, T1222.002
- First Time Python Spawned a Shell on Host severity medium T1059, T1059.004, T1059.006
- GitHub Actions Runner with Disabled Telemetry T1059, T1195, T1195.001, T1685
- Hidden AppleScript Download via Curl T1105, T1564, T1564.001
- Information Stealer Collection via Find T1074, T1074.001, T1119
- Initial Access Discovery via Applet Executable T1033, T1059, T1059.004
- Initial Access or Execution via Microsoft Office Application T1027, T1059, T1059.004, T1059.006, T1059.007, T1105
- Initial Access via Audio Unit Plug-in T1059, T1059.004
- Initial Access via macOS Installer Package T1059, T1059.004, T1082, T1105, T1204, T1204.002
- Initial Access via OSA Shell Script Piped to Python Interpreter T1059, T1059.006
- Javascript Reverse Shell via Nodejs T1059, T1059.007, T1195, T1195.001
- Keychain CommandLine Interaction via Unsigned or Untrusted Process severity high T1555, T1555.001
- Keychain Credential Files Collected via Archive Utility T1555, T1555.001
- Keychain Dump via Native Security Tool T1555, T1555.001
- Keychain Password Retrieval via Command Line severity high T1555, T1555.001, T1555.003
- Kill Command Executed from Binary in Unusual Location T1059, T1059.004, T1685
- Killall Execution via Python T1685
- Kubectl Network Configuration Modification severity low T1090, T1572
- Kubectl Permission Discovery severity medium T1069, T1613
- Kubectl Secrets Enumeration Across All Namespaces severity high T1552, T1613
- Kubernetes Direct API Request via Curl or Wget severity medium T1059, T1059.004, T1069, T1552, T1552.007, T1613
- Launchctl Submit Execution of Downloaded File T1569, T1569.001
- Launchpad Hijack T1574
- Lone Binary Execution from Volume Mount T1059, T1059.004
- MacOS Interactive Shell Spawned via Hidden Process T1059, T1059.004
- Malicious Homebrew Initial Access T1105, T1204
- Malicious Ledger Live Execution T1036, T1036.005
- Manual Loading of a Suspicious Chromium Extension severity high T1176, T1176.001, T1185, T1539
- Multi-Layered Deobfuscation via Unusual Parent T1027, T1140
- Network Connection to OAST Domain via Script Interpreter severity high T1059, T1102, T1195, T1195.001, T1567
- Network File Unzipped via Unsigned or Untrusted Binary T1027, T1059, T1059.004, T1140
- New System Kext File and Immediate Load via KextLoad T1059, T1059.004, T1547, T1547.006
- Node Script Execution and Immediate Deletion T1070, T1070.004
- Node.js Pre or Post-Install Script Execution severity medium T1059, T1059.004, T1059.007, T1195, T1195.001, T1204
- Nodejs Initial Access via VSCode Auto-run Task T1059, T1059.007, T1195, T1195.001
- Nodejs Javascript Execution via Osascript T1059, T1059.007
- NotificationCenter Silenced via Killall Binary T1685
- OSA Script Execution via Unsigned or Untrusted Parent T1059, T1059.002
- OsaScript Download Cradle Spawned T1008
- Osascript Execution via Piped AppleScript T1059, T1059.002
- Osascript Payload Drop and Execute T1105
- Payload Decoded and Decrypted via Built-In Utilities T1027, T1059, T1059.004, T1140, T1204, T1204.002
- Payload Delivery via Curl and Immediate Execution T1059, T1059.004, T1105
- Payload Piped to Script Interpreter T1059, T1059.006
- Pbpaste Execution via Unusual Parent Process severity high T1115
- Perl Outbound Network Connection severity medium T1059, T1059.006, T1071, T1071.001
- Persistence via GenAI Tool T1037, T1037.004, T1543, T1543.001, T1543.004, T1547
- Potential Access to Kerberos Cached Credentials T1558, T1558.005
- Potential Binary Masquerading via Invalid Code Signature T1036, T1036.001
- Potential ClickFix Attack via Base64 Decoded Payload T1204, T1204.001, T1566, T1566.002
- Potential Credential Harvesting via Python T1059, T1059.006, T1555
- Potential Credential Validation via Sudo from Unusual Parent T1056, T1056.002
- Potential Credentials Phishing via Osascript T1056, T1056.002
- Potential Data Exfiltration Through Curl severity medium T1048, T1048.001, T1048.003
- Potential Data Exfiltration via Curl T1048
- Potential Decoy Document via Open T1204, T1204.002
- Potential Execution via VS Code Tasks T1195, T1195.001, T1566, T1566.002
- Potential Git CVE-2025-48384 Exploitation severity high T1059, T1059.004, T1105, T1203
- Potential Git CVE-2025-48384 Exploitation T1203
- Potential Impersonation Attempt via Kubectl severity medium T1078, T1528, T1550, T1550.001, T1552
- Potential Kubectl Masquerading via Unexpected Process severity medium T1036, T1036.003, T1564, T1564.001, T1609, T1610
- Potential Masquerading as System Binary T1036, T1036.004, T1059, T1059.004
- Potential Persistence via Direct Crontab Modification T1053, T1053.003
- Potential Python Reverse Shell T1059, T1071
- Potential Python Stealer T1059, T1059.006, T1552, T1552.001
- Potential Reverse Shell Activity via Terminal T1059, T1071
- Potential SIP Bypass via the ShoveService T1068
- Potential TCC Bypass via Electron Web Inspector API T1218
- Potential WizardUpdate Malware Infection
- Potential XCSSET Malware Infection
- Powershell Outbound Network Connection T1059, T1059.001
- Privilege Escalation Enumeration via LinPEAS T1059, T1059.004
- Privileged Container Creation with Host Directory Mount severity high T1059, T1059.004, T1609, T1610, T1611
- Process Discovery via Built-In Applications severity low building block T1057, T1518, T1518.001
- Processes with Trailing Spaces severity low T1036, T1036.006
- Prompt for Credentials with Osascript severity high T1056, T1056.002, T1059, T1059.002
- Python Initial Access via Google Drive T1059, T1059.006, T1059.007, T1105
- Python Outbound Network Connection over FTP T1105
- Python Script Execution via Shell and Remote Network Connection T1059, T1059.006, T1105
- Quarantine Attribute Deleted via Untrusted Binary T1553, T1553.001
- Quarantine Cleared via Xattr Followed by Ad-hoc Codesign T1553, T1553.001
- Reading or Modifying Downloaded Files Database via SQLite Utility
- Remote GitHub Actions Runner Registration severity medium T1059, T1195, T1195.002, T1219
- ROT encoded Python Script Execution T1027, T1027.013, T1140
- Screensaver Plist File Modified by Unexpected Process T1546
- Script Interpreter Connection to Non-Standard Port severity medium T1059, T1059.005, T1059.006, T1059.007, T1571
- Self-Deleted Python Script Outbound Network Connection T1059, T1059.006, T1070, T1070.004, T1105
- Self-Deleting Python Script T1059, T1059.006, T1070, T1070.004
- Sensitive File Access via Rsync T1005, T1048
- Sensitive File Copy via Ditto T1005
- Shell Command Curl Execution via Osascript T1059, T1059.002, T1105
- Shell Command Discovery Execution via Untrusted Binary T1059, T1059.004
- Shell Command Piped to Osascript via Shell Script T1059, T1059.002, T1059.004
- Shell Execution via Apple Scripting severity medium T1059, T1059.002, T1059.004
- Shell Script Execution from abnormal Volume Mount Path T1059, T1059.004
- Shlayer Malware Infection T1105
- Sudo Heap-Based Buffer Overflow Attempt T1059, T1059.004, T1068
- SUID/SGID Bit Set severity low T1548, T1548.001
- Suspicious Apple Script Execution T1059, T1105
- Suspicious Archive Creation via Ditto T1074, T1074.001
- Suspicious Automator Application Execution T1059, T1059.002
- Suspicious Automator Workflows Execution T1059, T1059.007
- Suspicious Binary Execution via SSH T1059, T1059.004
- Suspicious Child Process Execution via Interactive Shell T1059, T1059.004
- Suspicious Child Process of Expect T1059, T1059.004
- Suspicious Codesign Execution via Osacompile T1059, T1059.004
- Suspicious Crypto Wallet Process Termination T1685
- Suspicious Curl Execution via Automator Workflow T1059, T1059.004, T1105
- Suspicious Curl Execution via NodeJS T1059, T1059.007, T1105
- Suspicious Curl File Download and Execution T1105
- Suspicious Curl from macOS Application severity high T1071, T1071.001, T1105, T1553, T1553.001
- Suspicious Curl to Jamf Endpoint severity high T1059, T1059.002, T1059.006, T1059.007, T1072
- Suspicious Curl to OAST Domain T1105
- Suspicious Curl to Raw IP via Perl T1105
- Suspicious Curl User Agent T1105
- Suspicious DD Execution T1027, T1059, T1059.004, T1140
- Suspicious Deobfuscation via Shell Script T1027, T1140
- Suspicious Dscl Auth Validation T1033, T1059, T1059.004
- Suspicious Electron Command Execution T1059, T1059.004
- Suspicious Elevated Command Execution T1059, T1059.004
- Suspicious Executable Copied from Volume Mount T1036, T1036.005
- Suspicious Executable Download via Curl T1059, T1059.002, T1105
- Suspicious Executable File Creation via Python T1059, T1059.006, T1105
- Suspicious Execution of Unsigned or Untrusted Process via Sudo T1059, T1059.004
- Suspicious Execution via Script Editor T1059, T1059.002, T1204, T1204.001, T1553, T1566
- Suspicious File Downloaded from Google Drive severity medium T1102, T1102.003, T1105
- Suspicious File Overwrite and Modification via Echo T1027, T1059, T1059.004
- Suspicious File Quarantine Removal via Find T1553, T1553.001
- Suspicious Hidden Executable and Immediate Network Connection T1071, T1071.001, T1105
- Suspicious Image Creation via ScreenCapture T1059, T1059.004, T1113
- Suspicious Installer Package Spawns Network Event severity medium T1059, T1059.002, T1059.004, T1059.006, T1059.007, T1071
- Suspicious Installer Remote Plugin Service Child Process T1559, T1559.003
- Suspicious Interactive Shell Execution T1059, T1059.004
- Suspicious Interpreter Execution from Stdin T1027, T1059, T1059.006
- Suspicious Large Script Execution via Shell Command T1059, T1059.002, T1059.004
- Suspicious macOS MS Office Child Process severity medium T1059, T1059.002, T1059.004, T1059.006, T1203, T1204
- Suspicious Network Connection to Gmail via Nodejs T1059, T1059.007, T1071, T1071.003
- Suspicious Network Connection via Installer Package T1059, T1059.007, T1071, T1071.001
- Suspicious Outbound Network Connection via Unsigned Binary severity high T1553, T1553.001, T1571
- Suspicious pbpaste High Volume Activity severity medium T1056, T1115
- Suspicious Perl Child Process Execution T1059, T1059.004
- Suspicious Privileged Docker Execution T1068, T1611
- Suspicious PrivilegedHelperTool Activity T1068
- Suspicious Python One-Liner with Encoded Payload Execution T1027, T1059, T1059.006
- Suspicious Python Package Child Process Execution T1059, T1059.004, T1059.006
- Suspicious Python Script Execution and Network Connection T1059, T1059.006
- Suspicious Python Shell Command Execution severity medium T1059, T1059.006
- Suspicious React Server Child Process severity high T1033, T1059, T1059.001, T1059.003, T1059.004, T1059.006
- Suspicious Recursive File Deletion via Built-In Utilities T1485, T1565
- Suspicious Remote Javascript Evaluation via Nodejs T1059, T1059.007
- Suspicious Script Compilation via Osacompile T1059, T1059.004
- Suspicious Script or Process Execution from Mounted Device T1204, T1204.002
- Suspicious SIP Check by macOS Application severity medium T1082, T1497, T1497.001
- Suspicious Terminal Child Process Execution T1059, T1059.004
- Suspicious Terraform Provider Execution and Network Connection T1071, T1071.001, T1195, T1195.002
- Suspicious TruffleHog Execution via NodeJS T1059, T1059.007, T1195, T1195.001, T1555
- Suspicious Unsigned Application Execution via Shell T1059, T1059.004
- Suspicious VSCode Extension Child Process T1105
- System Hosts File Access severity low building block T1016, T1018
- System Network Connections Discovery severity low building block T1016, T1049
- System Reconnaissance from Unsigned Parent Followed by Network Connection T1071, T1071.001, T1082
- SystemKey Access via Command Line T1555, T1555.001
- Tampering of Bash Command-Line History T1070, T1070.003
- Tampering of Shell Command-Line History severity medium T1070, T1070.003
- Tampering with RUNNER_TRACKING_ID in GitHub Actions Runners severity medium T1036, T1036.009, T1059, T1195, T1195.001, T1685
- Tccutil Reset via Suspicious Binary T1548, T1548.006
- Tclsh Execution followed by immediate Network Connection T1059
- Temporary Binary Execution via Osascript T1059, T1059.002
- Terminal closed with Pkill or Killall T1564, T1564.003
- Terminal Window Hidden or Closed via Osascript T1564, T1564.003
- Timestomping using Touch Command severity medium T1070, T1070.006
- Trap Signals Execution severity low T1546, T1546.005
- Unexpected Child Process of macOS Screensaver Engine T1546, T1546.002
- Unsigned or Untrusted binary Execution via Cron T1053, T1053.003
- Unsigned or Untrusted Binary Execution via XPC call T1059, T1059.004, T1559, T1559.003
- Unsigned or Untrusted Binary Execution via Zshrc T1546, T1546.004
- Unsigned or Untrusted Process Execution and Immediate Self-Deletion T1070, T1070.004
- Untrusted or Unsigned Binary Executed via Launch Service T1546, T1546.016
- Untrusted or Unsigned binary Execution via Osascript T1059, T1059.002
- Unusual Bundle Execution via Shell T1059, T1059.004
- Unusually large OSA script execution via Shell Command T1059, T1059.002
- Unusually Large Script Executed by Osascript T1059, T1059.002
- URL as argument to Python Script and Immediate Network Connection T1071, T1071.001, T1105
- User Discovery Command Execution from Volume Mount T1033, T1059, T1059.004
- User Keychain copied via Script Interpreter T1555, T1555.001
- User Keychain copied via Shell interpreter T1555, T1555.001
- User Keychain Copied via Suspicious Parent T1555, T1555.001
- User Keychain Exfiltration via Curl T1048, T1555, T1555.001
- Velociraptor Suspicious Shell Execution T1059, T1059.004, T1218, T1219
- Volume Muted via Osascript T1059, T1059.002
- Web Browsers Password Access via Command Line T1555, T1555.003
- WebProxy Settings Modification severity medium T1539, T1557