Detection rules › Sigma
macOS ESF Suspicious Process Execution
Detects suspicious process execution patterns commonly used in malware and attacks
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | No specific technique |
| Command & Control | No specific technique |
Event coverage
| Provider | Event | Title |
|---|---|---|
| ESF | exec | Process Execution (Notify) |
Rule body yaml
title: macOS ESF Suspicious Process Execution
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: experimental
description: Detects suspicious process execution patterns commonly used in malware and attacks
author: Eric Brown - Nebulock, Inc.
date: 2025/01/15
modified: 2025/01/15
logsource:
product: macos
service: endpointsecurity
category: process_creation
detection:
selection:
esf.event_type: 9
event.action: exec
Image|contains:
- '/tmp/'
- '/var/tmp/'
- '/dev/shm/'
CommandLine|contains:
- 'curl'
- 'wget'
- 'bash -c'
- 'python -c'
- '/bin/sh'
condition: selection
falsepositives:
- Legitimate system scripts and automation tools
level: medium
tags:
- attack.execution
- attack.command_and_control
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
esf.event_type: 9
event.action: exec
Image|contains:
- '/tmp/'
- '/var/tmp/'
- '/dev/shm/'
CommandLine|contains:
- 'curl'
- 'wget'
- 'bash -c'
- 'python -c'
- '/bin/sh'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
CommandLine | match |
|
Image | match |
|
esf.event_type | eq |
|
event.action | eq |
|