Detection rules › Sigma
macOS ESF Suspicious File Creation in Persistence Locations
Detects file creation in macOS persistence locations that could indicate malware installation
Known false positives
- Legitimate software installation
- System updates
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | No specific technique |
Telemetry coverage
Rule body
title: macOS ESF Suspicious File Creation in Persistence Locations
id: b2c3d4e5-f6a7-8901-bcde-f23456789012
status: experimental
description: Detects file creation in macOS persistence locations that could indicate malware installation
author: Eric Brown - Nebulock, Inc.
date: 2025/01/15
modified: 2025/01/15
logsource:
product: macos
service: endpointsecurity
category: file_create
detection:
selection:
event.action: create
TargetFilename|contains:
- '/Library/LaunchAgents'
- '/Library/LaunchDaemons'
- '/System/Library/LaunchAgents'
- '/System/Library/LaunchDaemons'
- '~/Library/LaunchAgents'
- '/Library/StartupItems'
condition: selection
falsepositives:
- Legitimate software installation
- System updates
level: high
tags:
- attack.persistence
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
event.action: create
TargetFilename|contains:
- '/Library/LaunchAgents'
- '/Library/LaunchDaemons'
- '/System/Library/LaunchAgents'
- '/System/Library/LaunchDaemons'
- '~/Library/LaunchAgents'
- '/Library/StartupItems'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
TargetFilename | match |
| field:"TargetFilename" kind:match |
event.action | eq |
| field:"EventType" kind:eq value:"create" |