Detection rules › Panther
macOS Malware Detected with osquery
Malware has potentially been detected on a macOS system
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Resource Development | T1588 Obtain Capabilities |
Rule body yaml
AnalysisType: rule
Filename: osquery_mac_osx_attacks.py
RuleID: "Osquery.Mac.OSXAttacks"
DisplayName: "macOS Malware Detected with osquery"
Enabled: true
LogTypes:
- Osquery.Differential
Tags:
- Osquery
- MacOS
- Malware
- Resource Development:Develop Capabilities
Reports:
MITRE ATT&CK:
- TA0042:T1588
Severity: Medium
Description: Malware has potentially been detected on a macOS system
Runbook: Check the executable against VirusTotal
Reference: https://github.com/osquery/osquery/blob/master/packs/osx-attacks.conf
SummaryAttributes:
- name
- hostIdentifier
- action
Tests:
- Name: Valid malware discovered
ExpectedResult: true
Log:
{
"name": "pack_osx-attacks_Leverage-A_1",
"action": "added",
"hostIdentifier": "test-host",
"columns":
{
"path": "/Users/johnny/Desktop/Siri.app/Contents/MacOS/Siri",
"pid": 100,
"name": "Siri",
},
}
- Name: Keyboard event taps query is ignored
ExpectedResult: false
Log:
{
"name": "pack_osx-attacks_Keyboard_Event_Taps",
"action": "added",
"hostIdentifier": "test-host",
"columns":
{
"path": "/System/Library/CoreServices/Siri.app/Contents/MacOS/Siri",
"pid": 100,
"name": "Siri",
},
}
Detection logic
Condition
name contains "osx-attacks"
name not contains "Keyboard_Event_Taps"
action eq "added"
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
name | contains | Keyboard_Event_Taps |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field |
|---|
hostIdentifier |