detection.wiki

Detection rules › Sigma

macOS XProtect Malware Detection

Status
experimental
Severity
critical
Log source
product macos, service endpointsecurity
Author
Eric Brown - Nebulock, Inc.
Source
github.com/Nebulock-Inc/macos-coresigma

Detects XProtect malware detection and remediation events. XProtect is Apple's built-in malware detection system. These events indicate confirmed malware presence and should trigger immediate incident response.

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1204 User Execution

Rule body yaml

title: macOS XProtect Malware Detection
id: c1a51851-4230-4141-9601-5d9f0cde7b96
status: experimental
description: 'Detects XProtect malware detection and remediation events. XProtect
  is Apple''s

  built-in malware detection system. These events indicate confirmed malware

  presence and should trigger immediate incident response.

  '
author: Eric Brown - Nebulock, Inc.
date: 2025/10/31
modified: 2025/10/31
references:
- https://attack.mitre.org/techniques/T1204/
- https://support.apple.com/guide/security/protecting-against-malware-sec469d47bd8/web
logsource:
  product: macos
  service: endpointsecurity
detection:
  selection_detected:
    esf.event_type: 112
    event.action: xp_malware_detected
  selection_remediated:
    esf.event_type: 113
    event.action: xp_malware_remediated
  condition: selection_detected or selection_remediated
falsepositives:
- Security testing with known malware samples
- False positives from XProtect signatures (rare)
fields:
- event_type
- event_name
- ProcessId
- Image
- User
- file_path
tags:
- attack.execution
- attack.t1204
- attack.initial_access
level: critical

Stages and Predicates

Stage 0: condition

selection_detected or selection_remediated

Stage 1: selection_detected

selection_detected:
  esf.event_type: 112
  event.action: xp_malware_detected

Stage 2: selection_remediated

selection_remediated:
  esf.event_type: 113
  event.action: xp_malware_remediated

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
esf.event_typeeq
  • 112
  • 113
event.actioneq
  • xp_malware_detected
  • xp_malware_remediated