detection.wiki

Detection rules › Sigma

macOS ULS Quarantine or XProtect Detection

Status
experimental
Severity
high
Log source
product macos, service unifiedlog
Author
Eric Brown - Nebulock, Inc.
Source
github.com/Nebulock-Inc/macos-coresigma

Detect logs referencing quarantine (LSQuarantine) or XProtect malware detections.

Known false positives

  • rare, but test systems may trigger intentionally

Rule body

title: macOS ULS Quarantine or XProtect Detection
id: 0a1b2c3d-4e5f-4789-abcd-ef0123456789
status: experimental
description: Detect logs referencing quarantine (LSQuarantine) or XProtect malware
  detections.
author: Eric Brown - Nebulock, Inc.
date: 2025-10-29
logsource:
  product: macos
  service: unifiedlog
level: high
detection:
  selection:
    message|contains:
    - LSQuarantine
    - XProtect
    - Malware removed
  condition: selection
falsepositives:
- rare, but test systems may trigger intentionally
modified: 2025/01/15

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
  message|contains:
  - LSQuarantine
  - XProtect
  - Malware removed

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
messagematch
  • LSQuarantine
  • Malware removed
  • XProtect
field:"message" kind:match