Detection rules › Sigma
SIGKILL Sent to Security Tools
Detects SIGKILL signals sent to security tools which may indicate defense evasion
Known false positives
- System updates
- Legitimate process management
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Defense Impairment |
Telemetry coverage
| Platform | Record / event type |
|---|---|
| macOS | ESF event signal (NOTIFY): Fires after a signal is delivered to a process. |
Rule body
title: SIGKILL Sent to Security Tools
id: 3028231e-acae-4e0b-88a6-3044502c7478
status: experimental
description: Detects SIGKILL signals sent to security tools which may indicate defense
evasion
references:
- https://attack.mitre.org/techniques/T1562/001/
author: Eric Brown - Nebulock, Inc.
date: 2025/10/29
tags:
- attack.defense_evasion
- attack.t1562.001
logsource:
product: macos
service: endpointsecurity
category: process_signal
detection:
selection:
esf.event_type: 27
event.action: signal
SignalNumber: 9
TargetImage|contains:
- LittleSnitch
- BlockBlock
- KnockKnock
- OverSight
- ReiKey
- Santa
- /xprotectd
- /MRT
- CrowdStrike
- SentinelOne
condition: selection
falsepositives:
- System updates
- Legitimate process management
level: high
modified: 2025/01/15
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
esf.event_type: 27
event.action: signal
SignalNumber: 9
TargetImage|contains:
- LittleSnitch
- BlockBlock
- KnockKnock
- OverSight
- ReiKey
- Santa
- /xprotectd
- /MRT
- CrowdStrike
- SentinelOne
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
SignalNumber | eq |
| field:"SignalNumber" kind:eq value:"9" |
TargetImage | match |
| field:"TargetImage" kind:match |
esf.event_type | eq |
| field:"esf.event_type" kind:eq value:"27" |
event.action | eq |
| field:"EventType" kind:eq value:"signal" |