macOS Authentication Events

Status: experimental
Severity: low
Log source: product macos, service unifiedlog
Author: Eric Brown - Nebulock, Inc.
Source: github.com/Nebulock-Inc/macos-coresigma

Detects authentication-related events from the macOS authorization subsystem. Monitors for login attempts, credential validation, and authorization requests which may indicate initial access attempts or compromised credentials.

Known false positives

Normal user authentication and login activity
System services performing authorized operations
Legitimate administrative tasks

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1078` Valid Accounts
Credential Access	`T1555` Credentials from Password Stores

Rule body

title: macOS Authentication Events
id: 3697a253-44ea-4276-b805-f07935c82538
status: experimental
description: 'Detects authentication-related events from the macOS authorization subsystem.

  Monitors for login attempts, credential validation, and authorization requests

  which may indicate initial access attempts or compromised credentials.

  '
author: Eric Brown - Nebulock, Inc.
date: 2025/10/31
modified: 2025/10/31
references:
- https://attack.mitre.org/techniques/T1078/
- https://developer.apple.com/documentation/os/logging
logsource:
  product: macos
  service: unifiedlog
detection:
  selection_subsystem:
    subsystem: com.apple.authorization
  selection_keywords:
    message|contains:
    - authentication
    - login
    - credential
    - authorize
  condition: selection_subsystem and selection_keywords
falsepositives:
- Normal user authentication and login activity
- System services performing authorized operations
- Legitimate administrative tasks
fields:
- subsystem
- category
- process
- message
- level
tags:
- attack.initial_access
- attack.t1078
- attack.credential_access
- attack.t1555
level: low

Stages and Predicates

Stage 0: `condition`

selection_subsystem and selection_keywords

Stage 1: `selection_subsystem`

selection_subsystem:
  subsystem: com.apple.authorization

Stage 2: `selection_keywords`

selection_keywords:
  message|contains:
  - authentication
  - login
  - credential
  - authorize

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`message`	match	`authentication` `authorize` `credential` `login`	`field:"message" kind:match`
`subsystem`	eq	`com.apple.authorization`	`field:"subsystem" kind:eq value:"com.apple.authorization"`