Detection rules › Sigma
macOS Authentication Events
Detects authentication-related events from the macOS authorization subsystem. Monitors for login attempts, credential validation, and authorization requests which may indicate initial access attempts or compromised credentials.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | T1078 Valid Accounts |
| Credential Access | T1555 Credentials from Password Stores |
Rule body yaml
title: macOS Authentication Events
id: 3697a253-44ea-4276-b805-f07935c82538
status: experimental
description: 'Detects authentication-related events from the macOS authorization subsystem.
Monitors for login attempts, credential validation, and authorization requests
which may indicate initial access attempts or compromised credentials.
'
author: Eric Brown - Nebulock, Inc.
date: 2025/10/31
modified: 2025/10/31
references:
- https://attack.mitre.org/techniques/T1078/
- https://developer.apple.com/documentation/os/logging
logsource:
product: macos
service: unifiedlog
detection:
selection_subsystem:
subsystem: com.apple.authorization
selection_keywords:
message|contains:
- authentication
- login
- credential
- authorize
condition: selection_subsystem and selection_keywords
falsepositives:
- Normal user authentication and login activity
- System services performing authorized operations
- Legitimate administrative tasks
fields:
- subsystem
- category
- process
- message
- level
tags:
- attack.initial_access
- attack.t1078
- attack.credential_access
- attack.t1555
level: low
Stages and Predicates
Stage 0: condition
selection_subsystem and selection_keywordsStage 1: selection_subsystem
selection_subsystem:
subsystem: com.apple.authorization
Stage 2: selection_keywords
selection_keywords:
message|contains:
- authentication
- login
- credential
- authorize
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.