Detection rules for macOS Data sources. Every rule contains its MITRE ATT&CK mapping, an impact rating, and details on what it identifies.

This category lists 36 detection rules.

Rule Example

Below is an example of a rule definition for Apple Script Abuse Detection (view in repository):

# Rule version v1.0.0

dataTypes:
  - macos
name: Apple Script Abuse Detection
impact:
  confidentiality: 3
  integrity: 3
  availability: 2
category: Execution
technique: "T1059.002 - Command and Scripting Interpreter: AppleScript"
adversary: origin
references:
  - https://attack.mitre.org/techniques/T1059/002/
  - https://developer.apple.com/documentation/os/logging
  - https://www.crowdstrike.com/en-us/blog/how-to-leverage-apple-unified-log-for-incident-response/
description: |
  Detects suspicious AppleScript execution that could indicate malicious activity, including osascript command-line usage, automation attempts, and script-based attacks on macOS systems. AppleScript can be abused by attackers to execute commands, interact with applications, and perform system manipulation.
  
  Next Steps:
  1. Review the specific AppleScript commands being executed
  2. Check if the script execution is part of legitimate automation or suspicious activity
  3. Examine the process tree to understand the execution context
  4. Verify if the user executing the script has legitimate reasons to do so
  5. Look for additional indicators of compromise on the affected system
  6. Consider blocking or monitoring the source if malicious intent is confirmed
where: |
  (oneOf("log.process", ["osascript", "Script Editor", "AppleScript", "Automator"]) ||
   contains("log.eventMessage", "osascript") ||
   contains("log.eventMessage", "AppleScript") ||
   equals("log.subsystem", "com.apple.applescript")) &&
  (contains("log.eventMessage", "tell application") ||
   contains("log.eventMessage", "do shell script") ||
   contains("log.eventMessage", "keystroke") ||
   contains("log.eventMessage", "System Events") ||
   contains("log.eventMessage", "admin privileges") ||
   contains("log.eventMessage", "sudo") ||
   contains("log.eventMessage", "password")) &&
  oneOf("log.eventType", ["logEvent", "traceEvent"])
groupBy:
  - adversary.host
  - adversary.user

Rule Details

Apple Script Abuse Detection

Identifies potentially malicious AppleScript activity, such as osascript use from the command line, automation efforts, and script-based attacks against macOS systems. Attackers can misuse AppleScript to run commands, communicate with applications, and manipulate the system.

• Category: Execution

• Technique: T1059.002 - Command and Scripting Interpreter: AppleScript

• Impact: C:3 / I:3 / A:2

• Rule file: apple_script_abuse.yml

• Reference: https://attack.mitre.org/techniques/T1059/002/

• Reference: https://developer.apple.com/documentation/os/logging

• Reference: https://www.crowdstrike.com/en-us/blog/how-to-leverage-apple-unified-log-for-incident-response/

Dynamic Library Hijacking Detected

Identifies dylib hijacking on macOS, in which attackers plant malicious dynamic libraries in paths checked ahead of valid libraries, enabling code to run under trusted applications.

• Category: Persistence

• Technique: T1574.004 - Hijack Execution Flow: Dylib Hijacking

• Impact: C:3 / I:3 / A:2

• Rule file: dylib_hijacking.yml

• Reference: https://attack.mitre.org/techniques/T1574/004/

• Reference: https://objective-see.org/blog/blog_0x46.html

Endpoint Security Framework Bypass Attempt

Identifies efforts to circumvent or alter the macOS Endpoint Security framework, a possible sign of malicious activity seeking to avoid security monitoring. This framework is essential for monitoring system security, and if compromised, it can let attackers work without being detected.

• Category: Defense Evasion

• Technique: T1562.001 - Impair Defenses: Disable or Modify Tools

• Impact: C:3 / I:3 / A:3

• Rule file: endpoint_security_bypass.yml

• Reference: https://attack.mitre.org/techniques/T1562/001/

• Reference: https://developer.apple.com/documentation/endpointsecurity

Folder Actions Script Abuse

Identifies misuse of macOS Folder Actions for persistence. Folder Actions permit scripts to be linked to folders and run when files are placed there, offering a covert persistence method.

• Category: Persistence

• Technique: T1546.002 - Event Triggered Execution: Screensaver

• Impact: C:2 / I:3 / A:1

• Rule file: folder_action_scripts.yml

• Reference: https://attack.mitre.org/techniques/T1546/002/

• Reference: https://posts.specterops.io/folder-actions-for-persistence-on-macos-8923f222343d

GUI Input Capture via Fake Password Dialog

Identifies osascript showing fraudulent password dialogs to collect user credentials. Attackers misuse AppleScript display dialog with hidden answer to create phishing prompts that imitate genuine macOS password requests, deceiving users into providing their credentials.

• Category: Credential Access

• Technique: T1056.002 - Input Capture: GUI Input Capture

• Impact: C:3 / I:2 / A:1

• Rule file: gui_input_capture.yml

• Reference: https://attack.mitre.org/techniques/T1056/002/

Gatekeeper Bypass Attempt Detected

Identifies efforts to evade Gatekeeper security checks by altering its database, deleting quarantine attributes, or exploiting assessment flaws. Gatekeeper is a macOS security function that checks downloaded applications before execution, and circumventing it can let malicious software run without correct verification.

• Category: Defense Evasion

• Technique: T1553.001 - Subvert Trust Controls: Gatekeeper Bypass

• Impact: C:2 / I:3 / A:2

• Rule file: gatekeeper_bypass_attempts.yml

• Reference: https://book.hacktricks.wiki/en/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-gatekeeper.html

• Reference: https://redcanary.com/blog/threat-detection/gatekeeper/

• Reference: https://attack.mitre.org/techniques/T1553/001/

Gatekeeper Bypass via Quarantine Attribute Removal

Identifies deletion of the com.apple.quarantine extended attribute from files with xattr -d. macOS Gatekeeper relies on this attribute to apply security checks to downloaded files. Deleting it enables unsigned or untrusted applications to run without Gatekeeper verification, evading a key security control.

• Category: Defense Evasion

• Technique: T1553.001 - Subvert Trust Controls: Gatekeeper Bypass

• Impact: C:2 / I:3 / A:2

• Rule file: gatekeeper_xattr_bypass.yml

• Reference: https://attack.mitre.org/techniques/T1553/001/

Hidden User Account Creation on macOS

Identifies hidden user account creation on macOS. Attackers set up hidden users, with UID below 500 and the IsHidden flag, to keep persistent, concealed access to compromised systems.

• Category: Persistence

• Technique: T1564.002 - Hide Artifacts: Hidden Users

• Impact: C:3 / I:3 / A:2

• Rule file: hidden_user_creation.yml

• Reference: https://attack.mitre.org/techniques/T1564/002/

JXA In-Memory Execution Detected

Identifies in-memory JavaScript for Automation execution through osascript. Attackers employ JXA with eval(), NSData.dataWithContentsOfURL, or ObjC.import to retrieve and run code wholly in memory, bypassing file-based detection. This is a macOS-specific fileless attack method.

• Category: Execution

• Technique: T1059.002 - Command and Scripting Interpreter: AppleScript

• Impact: C:3 / I:3 / A:2

• Rule file: jxa_in_memory_execution.yml

• Reference: https://attack.mitre.org/techniques/T1059/002/

• Reference: https://posts.specterops.io/persistent-jxa-66e1c3cd1cf5

Keychain Access Violations Detection

Identifies unauthorized or suspicious efforts to reach the macOS Keychain, such as failed access tries, access by unusual processes, and possible credential theft. This rule detects security subsystem events tied to keychain access failures, denials, or unauthorized attempts.

• Category: Credential Access

• Technique: T1555.001 - Credentials from Password Stores: Keychain

• Impact: C:3 / I:2 / A:1

• Rule file: keychain_access_violations.yml

• Reference: https://attack.mitre.org/techniques/T1555/001/

• Reference: https://support.apple.com/guide/keychain-access/mac-keychain-password-kyca1242/mac

• Reference: https://jumpcloud.com/support/understand-mac-keychain-access

Keychain Credential Dumping Detected

Identifies use of the macOS security command-line tool to pull credentials from the Keychain. Attackers use commands such as security find-certificate, security export, and security dump-keychain to gather stored certificates, passwords, and private keys from the macOS Keychain.

• Category: Credential Access

• Technique: T1555.001 - Credentials from Password Stores: Keychain

• Impact: C:3 / I:2 / A:1

• Rule file: keychain_credential_dumping.yml

• Reference: https://attack.mitre.org/techniques/T1555/001/

Keychain Credential Dumping via CLI

Identifies command-line access to macOS Keychain credentials through security commands such as dump-keychain, find-generic-password, or find-internet-password with the -w flag to retrieve passwords.

• Category: Credential Access

• Technique: T1555.001 - Credentials from Password Stores: Keychain

• Impact: C:3 / I:2 / A:0

• Rule file: keychain_dumping_cli.yml

• Reference: https://attack.mitre.org/techniques/T1555/001/

Launch Agent/Daemon Persistence Detection

Identifies suspicious creation or alteration of Launch Agents and Launch Daemons, which are often used for persistence on macOS systems. It watches for new plist files appearing in LaunchAgents or LaunchDaemons directories.

• Category: Persistence, Privilege Escalation

• Technique: T1543.001 - Create or Modify System Process: Launch Agent

• Impact: C:2 / I:3 / A:2

• Rule file: launch_agent_daemon_persistence.yml

• Reference: https://attack.mitre.org/techniques/T1543/001/

• Reference: https://developer.apple.com/documentation/os/logging

• Reference: https://www.crowdstrike.com/en-us/blog/how-to-leverage-apple-unified-log-for-incident-response/

Login Items Persistence Modification

Identifies changes to macOS Login Items, which are used to keep applications launching at user login. Attackers misuse this feature to sustain persistent access.

• Category: Persistence

• Technique: T1547.015 - Boot or Logon Autostart Execution: Login Items

• Impact: C:2 / I:3 / A:1

• Rule file: login_items_persistence.yml

• Reference: https://attack.mitre.org/techniques/T1547/015/

• Reference: https://developer.apple.com/documentation/servicemanagement

Notarization Bypass Attempt Detected

Identifies efforts to evade macOS notarization checks by methods such as altering quarantine attributes, abusing the AppleDouble file format, or exploiting ZIP archives. This rule detects suspicious activity that tries to get around Apple security mechanisms intended to protect users from malicious software.

• Category: Defense Evasion

• Technique: T1553.001 - Subvert Trust Controls: Gatekeeper Bypass

• Impact: C:2 / I:3 / A:1

• Rule file: notarization_bypass_attempts.yml

• Reference: https://redcanary.com/threat-detection-report/techniques/gatekeeper-bypass/

• Reference: https://attack.mitre.org/techniques/T1553/001/

Osascript Encoded or Suspicious Execution

Identifies suspicious osascript executions from the command line, such as encoded scripts, scripts that run shell commands, or scripts that modify the system. Attackers misuse AppleScript for execution and evasion.

• Category: Execution

• Technique: T1059.002 - Command and Scripting Interpreter: AppleScript

• Impact: C:3 / I:3 / A:2

• Rule file: osascript_encoded_execution.yml

• Reference: https://attack.mitre.org/techniques/T1059/002/

PlistBuddy Persistence via RunAtLoad

Identifies PlistBuddy being used to set RunAtLoad to true in LaunchAgent or LaunchDaemon plist files. This persistence technique involves attackers changing property list files so their malicious payload runs automatically at system boot or user login.

• Category: Persistence

• Technique: T1543.001 - Create or Modify System Process: Launch Agent

• Impact: C:2 / I:3 / A:2

• Rule file: plistbuddy_persistence.yml

• Reference: https://attack.mitre.org/techniques/T1543/001/

Privacy Preferences (TCC) Database Tampering

Identifies unauthorized changes to the macOS TCC (Transparency, Consent, and Control) database, which governs application privacy permissions. The TCC database manages access rights for sensitive resources such as camera, microphone, location services, and file system access. Unauthorized modification of this database can let malicious applications evade privacy controls and reach sensitive user data.

• Category: Privilege Escalation, Defense Evasion

• Technique: T1548 - Abuse Elevation Control Mechanism

• Impact: C:3 / I:3 / A:1

• Rule file: privacy_preferences_tampering.yml

• Reference: https://www.huntress.com/blog/full-transparency-controlling-apples-tcc

• Reference: https://attack.mitre.org/techniques/T1548/

SSH Private Key Theft Attempt

Identifies attempts to read or duplicate SSH private keys located in macOS user home directories, which attackers leverage for lateral movement and unauthorized remote system access.

• Category: Credential Access

• Technique: T1552.004 - Unsecured Credentials: Private Keys

• Impact: C:3 / I:2 / A:0

• Rule file: ssh_key_theft.yml

• Reference: https://attack.mitre.org/techniques/T1552/004/

Shell Profile Modification for Persistence

Identifies changes to shell profile files on macOS, such as .bash_profile, .zshrc, and .zprofile, which attackers use to run malicious commands whenever a shell session begins.

• Category: Persistence

• Technique: T1546.004 - Event Triggered Execution: Unix Shell Configuration Modification

• Impact: C:2 / I:3 / A:1

• Rule file: shell_profile_modification.yml

• Reference: https://attack.mitre.org/techniques/T1546/004/

Sudo Credential Caching Abuse

Identifies misuse of sudo credential caching on macOS, including timestamp tampering, sudoers file changes to lengthen timeout, and attempts to bypass tty_tickets.

• Category: Privilege Escalation

• Technique: T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching

• Impact: C:3 / I:3 / A:1

• Rule file: sudo_caching_abuse.yml

• Reference: https://attack.mitre.org/techniques/T1548/003/

Suspicious Browser Child Process on macOS

Identifies Safari, Chrome, and Firefox spawning suspicious child processes such as bash, curl, wget, python, or osascript. This behavior points to possible browser exploitation, drive-by download, or malicious content execution. Normal browsers seldom spawn shell interpreters or download utilities directly.

• Category: Initial Access

• Technique: T1189 - Drive-by Compromise

• Impact: C:3 / I:3 / A:2

• Rule file: browser_child_process_exploitation.yml

• Reference: https://attack.mitre.org/techniques/T1189/

• Reference: https://attack.mitre.org/techniques/T1203/

Suspicious Kernel Extension Loading Detected

Detects attempts to load kernel extensions (kexts) that are suspicious or unauthorized and could point to a rootkit being installed or the system being compromised. This rule watches for kext loading behavior that circumvents standard security safeguards, includes unsigned or invalid extensions, or takes place in sensitive system directories.

• Category: Persistence, Privilege Escalation

• Technique: T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions

• Impact: C:3 / I:3 / A:2

• Rule file: kernel_extension_loading.yml

• Reference: https://www.microsoft.com/en-us/security/blog/2025/01/13/analyzing-cve-2024-44243-a-macos-system-integrity-protection-bypass-through-kernel-extensions/

• Reference: https://attack.mitre.org/techniques/T1547/006/

Suspicious Office Application Child Process on macOS

Identifies Microsoft Office applications (Word, Excel, PowerPoint) spawning suspicious child processes such as bash, curl, wget, python, or osascript on macOS. This strongly suggests macro-based malware or document exploitation, since Office applications should not normally spawn shell interpreters or download utilities.

• Category: Execution

• Technique: T1204.002 - User Execution: Malicious File

• Impact: C:3 / I:3 / A:2

• Rule file: office_macro_exploitation.yml

• Reference: https://attack.mitre.org/techniques/T1204/002/

System Integrity Protection (SIP) Bypass Attempt

Identifies efforts to bypass System Integrity Protection (SIP) via unauthorized changes to protected locations or suspicious kernel extension loading with rootless entitlements. SIP is a vital macOS security mechanism that safeguards system files and processes from modification, even by privileged users.

• Category: Defense Evasion

• Technique: T1553.006 - Subvert Trust Controls: Code Signing Policy Modification

• Impact: C:3 / I:3 / A:2

• Rule file: system_integrity_protection_bypass.yml

• Reference: https://www.microsoft.com/en-us/security/blog/2025/01/13/analyzing-cve-2024-44243-a-macos-system-integrity-protection-bypass-through-kernel-extensions/

• Reference: https://attack.mitre.org/techniques/T1553/006/

TCC Database Manipulation Detected

Identifies unauthorized efforts to alter the Transparency, Consent, and Control (TCC) database in order to bypass privacy safeguards and reach protected resources. This detection covers multiple methods of TCC database manipulation, such as direct database changes, unauthorized access attempts, and privilege escalation using TCC bypass techniques.

• Category: Privilege Escalation, Defense Evasion

• Technique: T1548 - Abuse Elevation Control Mechanism

• Impact: C:3 / I:3 / A:2

• Rule file: tcc_database_manipulation.yml

• Reference: https://interpressecurity.com/resources/report/return-of-the-macos-transparency-consent-and-control-tcc-database-manipulation/

• Reference: https://www.sentinelone.com/labs/bypassing-macos-tcc-user-privacy-protections-by-accident-and-design/

• Reference: https://attack.mitre.org/techniques/T1548/

Time Machine Backup Deletion Detected

Detects the use of tmutil to remove Time Machine backups on macOS. This is a frequent ransomware precursor in which attackers erase backups to stop recovery after encryption. Genuine backup deletions are uncommon and warrant close monitoring.

• Category: Impact

• Technique: T1490 - Inhibit System Recovery

• Impact: C:1 / I:3 / A:3

• Rule file: time_machine_backup_deletion.yml

• Reference: https://attack.mitre.org/techniques/T1490/

User Added to Admin Group via dscl

Identifies use of dscl to add a user to the admin group on macOS. This is a privilege escalation technique in which attackers grant themselves or a compromised account administrative privileges to gain elevated access to the system.

• Category: Privilege Escalation

• Technique: T1078.003 - Valid Accounts: Local Accounts

• Impact: C:3 / I:3 / A:2

• Rule file: admin_group_addition.yml

• Reference: https://attack.mitre.org/techniques/T1078/003/

WizardUpdate Malware Indicators Detected

Identifies indicators of the WizardUpdate (UpdateAgent) macOS trojan. The malware relies on curl piped to bash/eval patterns and references characteristic paths such as intermediate_agent to stage and execute. WizardUpdate is a known macOS trojan that fetches and executes additional payloads.

• Category: Malware Detection

• Technique: T1059.002 - Command and Scripting Interpreter: AppleScript

• Impact: C:3 / I:3 / A:3

• Rule file: wizardupdate_malware.yml

• Reference: https://attack.mitre.org/techniques/T1059/002/

• Reference: https://www.sentinelone.com/blog/from-the-front-lines-new-macos-covid-malware-wizardupdate-changes-infection-tactics/

XCSSET Malware Indicators Detected

Identifies indicators of XCSSET malware on macOS. XCSSET is sophisticated malware that targets Xcode projects, steals browser data, and installs backdoors. Key indicators include curl requests to /sys/log.php C2 endpoints, osacompile commands in Library/Group Containers paths, and distinctive repl staging patterns.

• Category: Malware Detection

• Technique: T1059.002 - Command and Scripting Interpreter: AppleScript

• Impact: C:3 / I:3 / A:3

• Rule file: xcsset_malware.yml

• Reference: https://attack.mitre.org/techniques/T1059/002/

• Reference: https://www.trendmicro.com/en_us/research/20/h/xcsset-mac-malware--infects-xcode-projects--uses-0-days.html

XProtect Evasion or Tampering Detected

Identifies attempts to evade or tamper with XProtect malware detection, including modification of XProtect files, databases, or YARA rules. XProtect is Apple's built-in antimalware system, and efforts to bypass or disable it suggest possible malicious activity.

• Category: Defense Evasion

• Technique: T1562.001 - Impair Defenses: Disable or Modify Tools

• Impact: C:3 / I:3 / A:2

• Rule file: xprotect_evasion.yml

• Reference: https://www.sentinelone.com/blog/macos-malware-researchers-how-to-bypass-xprotect-on-catalina/

• Reference: https://attack.mitre.org/techniques/T1562/001/

macOS Cron Job Persistence

Identifies modifications to crontab on macOS systems. Although cron is deprecated on macOS in favor of launchd, attackers still use it for persistence because it is monitored less often.

• Category: Persistence

• Technique: T1053.003 - Scheduled Task/Job: Cron

• Impact: C:2 / I:3 / A:1

• Rule file: cron_job_persistence.yml

• Reference: https://attack.mitre.org/techniques/T1053/003/

macOS Ransomware Indicators

Identifies patterns of mass file encryption on macOS that may point to ransomware activity, such as rapid file changes with suspicious extensions and encryption tool usage.

• Category: Impact

• Technique: T1486 - Data Encrypted for Impact

• Impact: C:3 / I:3 / A:3

• Rule file: macos_ransomware_indicators.yml

• Reference: https://attack.mitre.org/techniques/T1486/

macOS Root Account Enabled

Detects the execution of dsenableroot to activate the root account on macOS. By default, macOS keeps the root account disabled for security reasons. Enabling it provides the highest tier of system privileges and is frequently performed by attackers to escalate privileges and maintain persistent elevated access.

• Category: Privilege Escalation

• Technique: T1078 - Valid Accounts

• Impact: C:3 / I:3 / A:2

• Rule file: root_account_enable.yml

• Reference: https://attack.mitre.org/techniques/T1078/

• Reference: https://support.apple.com/en-us/102367

macOS Security Tools Disabled

Identifies attempts to disable or unload macOS security tools by using launchctl or spctl. Attackers often disable endpoint security products such as LuLu, BlockBlock, Santa, CarbonBlack, CrowdStrike, and osquery, or turn off Gatekeeper through spctl to run malicious payloads without detection.

• Category: Defense Evasion

• Technique: T1562.001 - Impair Defenses: Disable or Modify Tools

• Impact: C:3 / I:3 / A:3

• Rule file: security_tools_disabling.yml

• Reference: https://attack.mitre.org/techniques/T1562/001/

macOS System Log Clearing Detected

Identifies attempts to clear or delete macOS system logs with rm, unlink, or shred commands aimed at /var/log or ~/Library/Logs directories. Attackers clear logs to remove evidence of their activity and obstruct forensic investigation.

• Category: Defense Evasion

• Technique: T1070.002 - Indicator Removal: Clear Linux or Mac System Logs

• Impact: C:1 / I:3 / A:2

• Rule file: system_log_clearing.yml

• Reference: https://attack.mitre.org/techniques/T1070/002/