detection.wiki

Detection rules › Sigma

macOS ULS securityd CodeSignature Failure

Status
experimental
Severity
medium
Log source
product macos, service unifiedlog
Author
Eric Brown - Nebulock, Inc.
Source
github.com/Nebulock-Inc/macos-coresigma

Detect logs from securityd indicating code signature failures which might reflect tampering.

Known false positives

  • developer builds or ad-hoc signing

Rule body

title: macOS ULS securityd CodeSignature Failure
id: e1c4dc0e-3a75-4f58-8e8f-5d4a9f9a1b2c
status: experimental
description: Detect logs from securityd indicating code signature failures which might
  reflect tampering.
author: Eric Brown - Nebulock, Inc.
date: 2025-10-29
logsource:
  product: macos
  service: unifiedlog
level: medium
detection:
  selection:
    subsystem: com.apple.securityd
    message|contains:
    - code signature invalid
    - rejecting
  condition: selection
falsepositives:
- developer builds or ad-hoc signing
modified: 2025/01/15

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
  subsystem: com.apple.securityd
  message|contains:
  - code signature invalid
  - rejecting

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
messagematch
  • code signature invalid
  • rejecting
field:"message" kind:match
subsystemeq
  • com.apple.securityd
field:"subsystem" kind:eq value:"com.apple.securityd"