Detection rules › Sigma
macOS ESF Suspicious W+X Memory Mapping
Detect processes creating writable and executable memory mappings which can indicate shellcode/JIT usage.
Known false positives
- legitimate JIT engines (e.g., browsers, VMs)
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth | No specific technique |
Rule body
title: macOS ESF Suspicious W+X Memory Mapping
id: 1d3f5c4b-3c5b-4a2a-bf6d-0d1a9e7f2d77
status: experimental
description: Detect processes creating writable and executable memory mappings which
can indicate shellcode/JIT usage.
author: Eric Brown - Nebulock, Inc.
date: 2025-10-29
logsource:
product: macos
service: endpointsecurity
level: high
detection:
selection_evt:
esf.event_type: 20
event.action: mprotect
selection_flags:
MemoryProtection|contains:
- wx
- xw
condition: selection_evt and selection_flags
falsepositives:
- legitimate JIT engines (e.g., browsers, VMs)
tags:
- attack.defense_evasion
modified: 2025/01/15
Stages and Predicates
Stage 0: condition
selection_evt and selection_flagsStage 1: selection_evt
selection_evt:
esf.event_type: 20
event.action: mprotect
Stage 2: selection_flags
selection_flags:
MemoryProtection|contains:
- wx
- xw
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
MemoryProtection | match |
| field:"MemoryProtection" kind:match |
esf.event_type | eq |
| field:"esf.event_type" kind:eq value:"20" |
event.action | eq |
| field:"EventType" kind:eq value:"mprotect" |