detection.wiki

Detection rules › Sigma

macOS ESF Suspicious File Creation in Persistence Locations

Status
experimental
Severity
high
Log source
product macos, category file_create, service endpointsecurity
Author
Eric Brown - Nebulock, Inc.
Source
github.com/Nebulock-Inc/macos-coresigma

Detects file creation in macOS persistence locations that could indicate malware installation

MITRE ATT&CK coverage

TacticTechniques
PersistenceNo specific technique

Rule body yaml

title: macOS ESF Suspicious File Creation in Persistence Locations
id: b2c3d4e5-f6a7-8901-bcde-f23456789012
status: experimental
description: Detects file creation in macOS persistence locations that could indicate malware installation
author: Eric Brown - Nebulock, Inc.
date: 2025/01/15
modified: 2025/01/15
logsource:
    product: macos
    service: endpointsecurity
    category: file_create
detection:
    selection:
        event.action: create
        TargetFilename|contains:
            - '/Library/LaunchAgents'
            - '/Library/LaunchDaemons'
            - '/System/Library/LaunchAgents'
            - '/System/Library/LaunchDaemons'
            - '~/Library/LaunchAgents'
            - '/Library/StartupItems'
    condition: selection
falsepositives:
    - Legitimate software installation
    - System updates
level: high
tags:
    - attack.persistence

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    event.action: create
    TargetFilename|contains:
        - '/Library/LaunchAgents'
        - '/Library/LaunchDaemons'
        - '/System/Library/LaunchAgents'
        - '/System/Library/LaunchDaemons'
        - '~/Library/LaunchAgents'
        - '/Library/StartupItems'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
TargetFilenamematch
  • /Library/LaunchAgents
  • /Library/LaunchDaemons
  • /Library/StartupItems
  • /System/Library/LaunchAgents
  • /System/Library/LaunchDaemons
  • ~/Library/LaunchAgents
event.actioneq
  • create