process_creation

File Download Via Nscurl - MacOS

Apr 16, 2025 · attack.defense-evasion attack.command-and-control attack.t1105 ·

Share on:

Detects the execution of the nscurl utility in order to download files.

Launch Agent/Daemon Execution Via Launchctl

Apr 16, 2025 · attack.execution attack.persistence attack.t1569.001 attack.t1543.001 attack.t1543.004 ·

Share on:

Detects the execution of programs as Launch Agents or Launch Daemons using launchctl on macOS.

New File Exclusion Added To Time Machine Via Tmutil - MacOS

Apr 16, 2025 · attack.impact attack.t1490 ·

Share on:

Detects the addition of a new file or path exclusion to MacOS Time Machine via the "tmutil" utility. An adversary could exclude a path from Time Machine backups to prevent certain files from being backed up.

System Information Discovery Via Sysctl - MacOS

Apr 16, 2025 · attack.defense-evasion attack.t1497.001 attack.discovery attack.t1082 ·

Share on:

Detects the execution of "sysctl" with specific arguments that have been used by threat actors and malware. It provides system hardware information. This process is primarily used to detect and avoid virtualization and analysis environments.

Time Machine Backup Deletion Attempt Via Tmutil - MacOS

Apr 16, 2025 · attack.impact attack.t1490 ·

Share on:

Detects deletion attempts of MacOS Time Machine backups via the native backup utility "tmutil". An adversary may perform this action before launching a ransonware attack to prevent the victim from restoring their files.

Time Machine Backup Disabled Via Tmutil - MacOS

Apr 16, 2025 · attack.impact attack.t1490 ·

Share on:

Detects disabling of Time Machine (Apple's automated backup utility software) via the native macOS backup utility "tmutil". An attacker can use this to prevent backups from occurring.

Remote Access Tool - Team Viewer Session Started On MacOS Host

Feb 3, 2025 · attack.initial-access attack.t1133 ·

Share on:

Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.

Potential Base64 Decoded From Images

Nov 1, 2024 · attack.defense-evasion attack.t1140 ·

Share on:

Detects the use of tail to extract bytes at an offset from an image and then decode the base64 value to create a new file with the decoded content. The detected execution is a bash one-liner.

System Information Discovery Using Ioreg

Nov 1, 2024 · attack.discovery attack.t1082 ·

Share on:

Detects the use of "ioreg" which will show I/O Kit registry information. This process is used for system information discovery. It has been observed in-the-wild by calling this process directly or using bash and grep to look for specific strings.

System Information Discovery Using sw_vers

Nov 1, 2024 · attack.discovery attack.t1082 ·

Share on:

Detects the use of "sw_vers" for system information discovery

System Information Discovery Using System_Profiler

Nov 1, 2024 · attack.discovery attack.defense-evasion attack.t1082 attack.t1497.001 ·

Share on:

Detects the execution of "system_profiler" with specific "Data Types" that have been seen being used by threat actors and malware. It provides system hardware and software configuration information. This process is primarily used for system information discovery. However, "system_profiler" can also be used to determine if virtualization software is being run for defense evasion purposes.

System Integrity Protection (SIP) Disabled

Nov 1, 2024 · attack.discovery attack.t1518.001 ·

Share on:

Detects the use of csrutil to disable the Configure System Integrity Protection (SIP). This technique is used in post-exploit scenarios.

System Integrity Protection (SIP) Enumeration

Nov 1, 2024 · attack.discovery attack.t1518.001 ·

Share on:

Detects the use of csrutil to view the Configure System Integrity Protection (SIP) status. This technique is used in post-exploit scenarios.

System Network Discovery - macOS

Aug 29, 2024 · attack.discovery attack.t1016 ·

Share on:

Detects enumeration of local network configuration

Hidden Flag Set On File/Directory Via Chflags - MacOS

Aug 21, 2024 · attack.defense-evasion attack.t1218 attack.t1564.004 attack.t1552.001 attack.t1105 ·

Share on:

Detects the execution of the "chflags" utility with the "hidden" flag, in order to hide files on MacOS. When a file or directory has this hidden flag set, it becomes invisible to the default file listing commands and in graphical file browsers.

Binary Padding - MacOS

Aug 12, 2024 · attack.defense-evasion attack.t1027.001 ·

Share on:

Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This rule detect using dd and truncate to add a junk data to file.

Clipboard Data Collection Via OSAScript

Aug 12, 2024 · attack.collection attack.execution attack.t1115 attack.t1059.002 ·

Share on:

Detects possible collection of data from the clipboard via execution of the osascript binary

Creation Of A Local User Account

Aug 12, 2024 · attack.t1136.001 attack.persistence ·

Share on:

Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.

Credentials from Password Stores - Keychain

Aug 12, 2024 · attack.credential-access attack.t1555.001 ·

Share on:

Detects passwords dumps from Keychain

Credentials In Files

Aug 12, 2024 · attack.credential-access attack.t1552.001 ·

Share on:

Detecting attempts to extract passwords with grep and laZagne

Decode Base64 Encoded Text -MacOs

Aug 12, 2024 · attack.defense-evasion attack.t1027 ·

Share on:

Detects usage of base64 utility to decode arbitrary base64-encoded text

Disable Security Tools

Aug 12, 2024 · attack.defense-evasion attack.t1562.001 ·

Share on:

Detects disabling security tools

Disk Image Creation Via Hdiutil - MacOS

Aug 12, 2024 · attack.exfiltration ·

Share on:

Detects the execution of the hdiutil utility in order to create a disk image.

Disk Image Mounting Via Hdiutil - MacOS

Aug 12, 2024 · attack.initial-access attack.t1566.001 attack.t1560.001 ·

Share on:

Detects the execution of the hdiutil utility in order to mount disk images.

File and Directory Discovery - MacOS

Aug 12, 2024 · attack.discovery attack.t1083 ·

Share on:

Detects usage of system utilities to discover files and directories

File Time Attribute Change

Aug 12, 2024 · attack.defense-evasion attack.t1070.006 ·

Share on:

Detect file time attribute change to hide new or changes to existing files

Gatekeeper Bypass via Xattr

Aug 12, 2024 · attack.defense-evasion attack.t1553.001 ·

Share on:

Detects macOS Gatekeeper bypass via xattr utility

Guest Account Enabled Via Sysadminctl

Aug 12, 2024 · attack.initial-access attack.t1078 attack.t1078.001 ·

Share on:

Detects attempts to enable the guest account using the sysadminctl utility

GUI Input Capture - macOS

Aug 12, 2024 · attack.credential-access attack.t1056.002 ·

Share on:

Detects attempts to use system dialog prompts to capture user credentials

Hidden User Creation

Aug 12, 2024 · attack.defense-evasion attack.t1564.002 ·

Share on:

Detects creation of a hidden user account on macOS (UserID < 500) or with IsHidden option

Indicator Removal on Host - Clear Mac System Logs

Aug 12, 2024 · attack.defense-evasion attack.t1070.002 ·

Share on:

Detects deletion of local audit logs

JAMF MDM Execution

Aug 12, 2024 · attack.execution ·

Share on:

Detects execution of the "jamf" binary to create user accounts and run commands. For example, the binary can be abused by attackers on the system in order to bypass security controls or remove application control polices.

JAMF MDM Potential Suspicious Child Process

Aug 12, 2024 · attack.execution ·

Share on:

Detects potential suspicious child processes of "jamf". Could be a sign of potential abuse of Jamf as a C2 server as seen by Typhon MythicAgent.

JXA In-memory Execution Via OSAScript

Aug 12, 2024 · attack.t1059.002 attack.t1059.007 attack.execution ·

Share on:

Detects possible malicious execution of JXA in-memory via OSAScript

Local Groups Discovery - MacOs

Aug 12, 2024 · attack.discovery attack.t1069.001 ·

Share on:

Detects enumeration of local system groups

Local System Accounts Discovery - MacOs

Aug 12, 2024 · attack.discovery attack.t1087.001 ·

Share on:

Detects enumeration of local systeam accounts on MacOS

MacOS Network Service Scanning

Aug 12, 2024 · attack.discovery attack.t1046 ·

Share on:

Detects enumeration of local or remote network services.

Macos Remote System Discovery

Aug 12, 2024 · attack.discovery attack.t1018 ·

Share on:

Detects the enumeration of other remote systems.

MacOS Scripting Interpreter AppleScript

Aug 12, 2024 · attack.execution attack.t1059.002 ·

Share on:

Detects execution of AppleScript of the macOS scripting language AppleScript.

Network Sniffing - MacOs

Aug 12, 2024 · attack.discovery attack.credential-access attack.t1040 ·

Share on:

Detects the usage of tooling to sniff network traffic. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.

Osacompile Execution By Potentially Suspicious Applet/Osascript

Aug 12, 2024 · attack.execution attack.t1059.002 ·

Share on:

Detects potential suspicious applet or osascript executing "osacompile".

OSACompile Run-Only Execution

Aug 12, 2024 · attack.t1059.002 attack.execution ·

Share on:

Detects potential suspicious run-only executions compiled using OSACompile

Payload Decoded and Decrypted via Built-in Utilities

Aug 12, 2024 · attack.t1059 attack.t1204 attack.execution attack.t1140 attack.defense-evasion attack.s0482 attack.s0402 ·

Share on:

Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.

Potential Discovery Activity Using Find - MacOS

Aug 12, 2024 · attack.discovery attack.t1083 ·

Share on:

Detects usage of "find" binary in a suspicious manner to perform discovery

Potential In-Memory Download And Compile Of Payloads

Aug 12, 2024 · attack.command-and-control attack.execution attack.t1059.007 attack.t1105 ·

Share on:

Detects potential in-memory downloading and compiling of applets using curl and osacompile as seen used by XCSSET malware

Potential Persistence Via PlistBuddy

Aug 12, 2024 · attack.persistence attack.t1543.001 attack.t1543.004 ·

Share on:

Detects potential persistence activity using LaunchAgents or LaunchDaemons via the PlistBuddy utility

Potential WizardUpdate Malware Infection

Aug 12, 2024 · attack.command-and-control ·

Share on:

Detects the execution traces of the WizardUpdate malware. WizardUpdate is a macOS trojan that attempts to infiltrate macOS machines to steal data and it is associated with other types of malicious payloads, increasing the chances of multiple infections on a device.

Root Account Enable Via Dsenableroot

Aug 12, 2024 · attack.t1078 attack.t1078.001 attack.t1078.003 attack.initial-access attack.persistence ·

Share on:

Detects attempts to enable the root account via "dsenableroot"

Scheduled Cron Task/Job - MacOs

Aug 12, 2024 · attack.execution attack.persistence attack.privilege-escalation attack.t1053.003 ·

Share on:

Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detection will focus on crontab jobs uploaded from the tmp folder.

Screen Capture - macOS

Aug 12, 2024 · attack.collection attack.t1113 ·

Share on:

Detects attempts to use screencapture to collect macOS screenshots

Security Software Discovery - MacOs

Aug 12, 2024 · attack.discovery attack.t1518.001 ·

Share on:

Detects usage of system utilities (only grep for now) to discover security software discovery

Space After Filename - macOS

Aug 12, 2024 · attack.defense-evasion attack.t1036.006 ·

Share on:

Detects attempts to masquerade as legitimate files by adding a space to the end of the filename.

Split A File Into Pieces

Aug 12, 2024 · attack.exfiltration attack.t1030 ·

Share on:

Detection use of the command "split" to split files into parts and possible transfer.

Suspicious Browser Child Process - MacOS

Aug 12, 2024 · attack.initial-access attack.execution attack.t1189 attack.t1203 attack.t1059 ·

Share on:

Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.

Suspicious Execution via macOS Script Editor

Aug 12, 2024 · attack.t1566 attack.t1566.002 attack.initial-access attack.t1059 attack.t1059.002 attack.t1204 attack.t1204.001 attack.execution attack.persistence attack.t1553 attack.defense-evasion ·

Share on:

Detects when the macOS Script Editor utility spawns an unusual child process.

Suspicious History File Operations

Aug 12, 2024 · attack.credential-access attack.t1552.003 ·

Share on:

Detects commandline operations on shell history files

Suspicious Installer Package Child Process

Aug 12, 2024 · attack.t1059 attack.t1059.007 attack.t1071 attack.t1071.001 attack.execution attack.command-and-control ·

Share on:

Detects the execution of suspicious child processes from macOS installer package parent process. This includes osascript, JXA, curl and wget amongst other interpreters

Suspicious MacOS Firmware Activity

Aug 12, 2024 · attack.impact ·

Share on:

Detects when a user manipulates with Firmward Password on MacOS. NOTE - this command has been disabled on silicon-based apple computers.

Suspicious Microsoft Office Child Process - MacOS

Aug 12, 2024 · attack.execution attack.persistence attack.t1059.002 attack.t1137.002 attack.t1204.002 ·

Share on:

Detects suspicious child processes spawning from microsoft office suite applications such as word or excel. This could indicates malicious macro execution