macos

Excessive Sudo Authentication Failures via macOS Security Events

Oct 7, 2026 · Domain: Endpoint OS: macOS Platform: macOS Use Case: Threat Detection Tactic: Privilege Escalation Tactic: Credential Access Data Source: macOS Security Events Rule Type: ESQL Resources: Investigation Guide ·

Share on:

Identifies a high number of failed sudo password attempts on a macOS host within a short time window, using sudo messages collected by the Authentication data stream of the macOS Security Events integration. Repeated sudo authentication failures may indicate an adversary with access to a low-privileged account attempting to guess an administrator password to escalate privileges.

Launch Item Registration with Suspicious Executable Path via macOS Security Events

Oct 7, 2026 · OS: macOS Use Case: Threat Detection Tactic: Persistence Data Source: macOS Security Events Resources: Investigation Guide Rule Type: ESQL Platform: macOS Domain: Endpoint ·

Share on:

Identifies the registration of a launch agent or launch daemon whose target executable resides in a temporary or user-writable location, using launch item registration messages collected by the macOS Security Events integration. An adversary may establish persistence with a launch agent or daemon that runs a program staged in a world-writable or temporary directory, which is uncommon for legitimate software.

Persistence via a Hidden Plist Filename via macOS Security Events

Oct 7, 2026 · OS: macOS Use Case: Threat Detection Tactic: Persistence Tactic: Defense Evasion Data Source: macOS Security Events Resources: Investigation Guide Rule Type: ESQL Platform: macOS Domain: Endpoint ·

Share on:

Identifies the registration of a launch agent or launch daemon whose property list (plist) filename begins with a dot, using launch item registration messages collected by the macOS Security Events integration. An adversary may establish persistence by installing a launch agent or daemon that executes at login or boot; plist files with filenames starting with a dot are hidden from default directory listings and are particularly suspicious.

Potential SSH Brute Force Detected via macOS Security Events

Oct 7, 2026 · OS: macOS Use Case: Threat Detection Tactic: Credential Access Data Source: macOS Security Events Resources: Investigation Guide Rule Type: ES|QL Platform: macOS Domain: Endpoint ·

Share on:

Identifies a high number of failed inbound SSH authentication attempts on a macOS host within a short time window, using sshd authentication messages collected by the macOS Security Events integration. Adversaries may perform password brute force or password spraying against exposed SSH services to obtain unauthorized access.

Potential Successful SSH Brute Force Attack via macOS Security Events

Oct 7, 2026 · OS: macOS Use Case: Threat Detection Tactic: Credential Access Tactic: Initial Access Data Source: macOS Security Events Resources: Investigation Guide Rule Type: Event Correlation (EQL) Platform: macOS Domain: Endpoint ·

Share on:

Identifies a burst of failed inbound SSH authentication attempts on a macOS host followed shortly by a successful SSH authentication on the same host, using sshd authentication messages collected by the macOS Security Events integration. A successful login immediately after repeated failures indicates that a password brute force or password spraying attack against an exposed SSH service has likely succeeded.