UTMSTACK logoUTMSTACK logo
macOS

Detection rules for macOS data sources. Each rule includes its MITRE ATT&CK mapping, impact rating, and a description of what it detects.

This category contains 36 detection rules.

RuleCategoryTechniqueImpact (C/I/A)
Apple Script Abuse DetectionExecutionT1059.002 - Command and Scripting Interpreter: AppleScriptC:3 / I:3 / A:2
Dynamic Library Hijacking DetectedPersistenceT1574.004 - Hijack Execution Flow: Dylib HijackingC:3 / I:3 / A:2
Endpoint Security Framework Bypass AttemptDefense EvasionT1562.001 - Impair Defenses: Disable or Modify ToolsC:3 / I:3 / A:3
Folder Actions Script AbusePersistenceT1546.002 - Event Triggered Execution: ScreensaverC:2 / I:3 / A:1
GUI Input Capture via Fake Password DialogCredential AccessT1056.002 - Input Capture: GUI Input CaptureC:3 / I:2 / A:1
Gatekeeper Bypass Attempt DetectedDefense EvasionT1553.001 - Subvert Trust Controls: Gatekeeper BypassC:2 / I:3 / A:2
Gatekeeper Bypass via Quarantine Attribute RemovalDefense EvasionT1553.001 - Subvert Trust Controls: Gatekeeper BypassC:2 / I:3 / A:2
Hidden User Account Creation on macOSPersistenceT1564.002 - Hide Artifacts: Hidden UsersC:3 / I:3 / A:2
JXA In-Memory Execution DetectedExecutionT1059.002 - Command and Scripting Interpreter: AppleScriptC:3 / I:3 / A:2
Keychain Access Violations DetectionCredential AccessT1555.001 - Credentials from Password Stores: KeychainC:3 / I:2 / A:1
Keychain Credential Dumping DetectedCredential AccessT1555.001 - Credentials from Password Stores: KeychainC:3 / I:2 / A:1
Keychain Credential Dumping via CLICredential AccessT1555.001 - Credentials from Password Stores: KeychainC:3 / I:2 / A:0
Launch Agent/Daemon Persistence DetectionPersistence, Privilege EscalationT1543.001 - Create or Modify System Process: Launch AgentC:2 / I:3 / A:2
Login Items Persistence ModificationPersistenceT1547.015 - Boot or Logon Autostart Execution: Login ItemsC:2 / I:3 / A:1
Notarization Bypass Attempt DetectedDefense EvasionT1553.001 - Subvert Trust Controls: Gatekeeper BypassC:2 / I:3 / A:1
Osascript Encoded or Suspicious ExecutionExecutionT1059.002 - Command and Scripting Interpreter: AppleScriptC:3 / I:3 / A:2
PlistBuddy Persistence via RunAtLoadPersistenceT1543.001 - Create or Modify System Process: Launch AgentC:2 / I:3 / A:2
Privacy Preferences (TCC) Database TamperingPrivilege Escalation, Defense EvasionT1548 - Abuse Elevation Control MechanismC:3 / I:3 / A:1
SSH Private Key Theft AttemptCredential AccessT1552.004 - Unsecured Credentials: Private KeysC:3 / I:2 / A:0
Shell Profile Modification for PersistencePersistenceT1546.004 - Event Triggered Execution: Unix Shell Configuration ModificationC:2 / I:3 / A:1
Sudo Credential Caching AbusePrivilege EscalationT1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo CachingC:3 / I:3 / A:1
Suspicious Browser Child Process on macOSInitial AccessT1189 - Drive-by CompromiseC:3 / I:3 / A:2
Suspicious Kernel Extension Loading DetectedPersistence, Privilege EscalationT1547.006 - Boot or Logon Autostart Execution: Kernel Modules and ExtensionsC:3 / I:3 / A:2
Suspicious Office Application Child Process on macOSExecutionT1204.002 - User Execution: Malicious FileC:3 / I:3 / A:2
System Integrity Protection (SIP) Bypass AttemptDefense EvasionT1553.006 - Subvert Trust Controls: Code Signing Policy ModificationC:3 / I:3 / A:2
TCC Database Manipulation DetectedPrivilege Escalation, Defense EvasionT1548 - Abuse Elevation Control MechanismC:3 / I:3 / A:2
Time Machine Backup Deletion DetectedImpactT1490 - Inhibit System RecoveryC:1 / I:3 / A:3
User Added to Admin Group via dsclPrivilege EscalationT1078.003 - Valid Accounts: Local AccountsC:3 / I:3 / A:2
WizardUpdate Malware Indicators DetectedMalware DetectionT1059.002 - Command and Scripting Interpreter: AppleScriptC:3 / I:3 / A:3
XCSSET Malware Indicators DetectedMalware DetectionT1059.002 - Command and Scripting Interpreter: AppleScriptC:3 / I:3 / A:3
XProtect Evasion or Tampering DetectedDefense EvasionT1562.001 - Impair Defenses: Disable or Modify ToolsC:3 / I:3 / A:2
macOS Cron Job PersistencePersistenceT1053.003 - Scheduled Task/Job: CronC:2 / I:3 / A:1
macOS Ransomware IndicatorsImpactT1486 - Data Encrypted for ImpactC:3 / I:3 / A:3
macOS Root Account EnabledPrivilege EscalationT1078 - Valid AccountsC:3 / I:3 / A:2
macOS Security Tools DisabledDefense EvasionT1562.001 - Impair Defenses: Disable or Modify ToolsC:3 / I:3 / A:3
macOS System Log Clearing DetectedDefense EvasionT1070.002 - Indicator Removal: Clear Linux or Mac System LogsC:1 / I:3 / A:2

Rule Example

Below is an example of a rule definition for Apple Script Abuse Detection (view in repository):

# Rule version v1.0.0

dataTypes:
  - macos
name: Apple Script Abuse Detection
impact:
  confidentiality: 3
  integrity: 3
  availability: 2
category: Execution
technique: "T1059.002 - Command and Scripting Interpreter: AppleScript"
adversary: origin
references:
  - https://attack.mitre.org/techniques/T1059/002/
  - https://developer.apple.com/documentation/os/logging
  - https://www.crowdstrike.com/en-us/blog/how-to-leverage-apple-unified-log-for-incident-response/
description: |
  Detects suspicious AppleScript execution that could indicate malicious activity, including osascript command-line usage, automation attempts, and script-based attacks on macOS systems. AppleScript can be abused by attackers to execute commands, interact with applications, and perform system manipulation.
  
  Next Steps:
  1. Review the specific AppleScript commands being executed
  2. Check if the script execution is part of legitimate automation or suspicious activity
  3. Examine the process tree to understand the execution context
  4. Verify if the user executing the script has legitimate reasons to do so
  5. Look for additional indicators of compromise on the affected system
  6. Consider blocking or monitoring the source if malicious intent is confirmed
where: |
  (oneOf("log.process", ["osascript", "Script Editor", "AppleScript", "Automator"]) ||
   contains("log.eventMessage", "osascript") ||
   contains("log.eventMessage", "AppleScript") ||
   equals("log.subsystem", "com.apple.applescript")) &&
  (contains("log.eventMessage", "tell application") ||
   contains("log.eventMessage", "do shell script") ||
   contains("log.eventMessage", "keystroke") ||
   contains("log.eventMessage", "System Events") ||
   contains("log.eventMessage", "admin privileges") ||
   contains("log.eventMessage", "sudo") ||
   contains("log.eventMessage", "password")) &&
  oneOf("log.eventType", ["logEvent", "traceEvent"])
groupBy:
  - adversary.host
  - adversary.user

Rule Details

Apple Script Abuse Detection

Detects suspicious AppleScript execution that could indicate malicious activity, including osascript command-line usage, automation attempts, and script-based attacks on macOS systems. AppleScript can be abused by attackers to execute commands, interact with applications, and perform system manipulation.

Dynamic Library Hijacking Detected

Detects dynamic library (dylib) hijacking on macOS where attackers place malicious dylibs in locations searched before legitimate libraries, allowing code execution in the context of trusted applications.

Endpoint Security Framework Bypass Attempt

Detects attempts to bypass or tamper with the macOS Endpoint Security framework, which could indicate malicious activity trying to evade security monitoring. The Endpoint Security framework is a critical component for system security monitoring and its compromise can allow attackers to operate undetected.

Folder Actions Script Abuse

Detects abuse of macOS Folder Actions to establish persistence. Folder Actions allow scripts to be attached to folders and execute when files are added, providing a stealthy persistence mechanism.

GUI Input Capture via Fake Password Dialog

Detects osascript displaying fake password dialogs to capture user credentials. Attackers abuse AppleScript's "display dialog" with "hidden answer" to present phishing prompts that mimic legitimate macOS password requests, tricking users into entering their credentials.

Gatekeeper Bypass Attempt Detected

Detects attempts to bypass Gatekeeper security checks through database manipulation, quarantine attribute removal, or exploitation of assessment vulnerabilities. Gatekeeper is a macOS security feature that verifies downloaded applications before they run, and bypassing it can allow malicious software to execute without proper verification.

Gatekeeper Bypass via Quarantine Attribute Removal

Detects the removal of the com.apple.quarantine extended attribute from files using xattr -d. macOS Gatekeeper uses this attribute to enforce security checks on downloaded files. Removing it allows unsigned or untrusted applications to execute without Gatekeeper verification, bypassing a critical security control.

Hidden User Account Creation on macOS

Detects creation of hidden user accounts on macOS. Attackers create hidden users (UID < 500, IsHidden flag) to maintain persistent, stealthy access to compromised systems.

JXA In-Memory Execution Detected

Detects JavaScript for Automation (JXA) in-memory execution via osascript. Attackers use JXA with eval(), NSData.dataWithContentsOfURL, or ObjC.import to download and execute code entirely in memory, avoiding file-based detection. This is a fileless attack technique specific to macOS.

Keychain Access Violations Detection

Detects unauthorized or suspicious attempts to access macOS Keychain, including failed access attempts, unusual process access, and potential credential theft activities. This rule identifies security subsystem events related to keychain access failures, denials, or unauthorized attempts.

Keychain Credential Dumping Detected

Detects the use of the macOS security command-line tool to extract credentials from the Keychain. Commands like "security find-certificate", "security export", and "security dump-keychain" are used by attackers to harvest stored certificates, passwords, and private keys from the macOS Keychain.

Keychain Credential Dumping via CLI

Detects command-line access to macOS Keychain credentials using security commands like dump-keychain, find-generic-password, or find-internet-password with the -w flag to extract passwords.

Launch Agent/Daemon Persistence Detection

Detects suspicious creation or modification of Launch Agents and Launch Daemons which are commonly used for persistence on macOS systems. Monitors for new plist files being created in LaunchAgents or LaunchDaemons directories.

Login Items Persistence Modification

Detects modifications to Login Items on macOS which are used to persist applications that launch at user login. Attackers abuse this mechanism to maintain persistent access.

Notarization Bypass Attempt Detected

Detects attempts to bypass macOS notarization checks through various methods including quarantine attribute manipulation, AppleDouble file format abuse, or ZIP archive exploitation. This rule identifies suspicious activities that attempt to circumvent Apple's security mechanisms designed to protect users from malicious software.

Osascript Encoded or Suspicious Execution

Detects suspicious osascript executions from the command line including encoded scripts, scripts executing shell commands, or scripts performing system modifications. Attackers abuse AppleScript for execution and evasion.

PlistBuddy Persistence via RunAtLoad

Detects the use of PlistBuddy to set RunAtLoad to true in LaunchAgent or LaunchDaemon plist files. This is a persistence technique where attackers modify property list files to ensure their malicious payload runs automatically at system boot or user login.

Privacy Preferences (TCC) Database Tampering

Detects unauthorized modifications to the macOS TCC (Transparency, Consent, and Control) database which controls application privacy permissions. The TCC database manages access permissions for sensitive resources like camera, microphone, location services, and file system access. Unauthorized modifications to this database can allow malicious applications to bypass privacy controls and gain access to sensitive user data.

SSH Private Key Theft Attempt

Detects attempts to access or copy SSH private keys from user home directories on macOS, which attackers use for lateral movement and unauthorized access to remote systems.

Shell Profile Modification for Persistence

Detects modifications to shell profile files (.bash_profile, .zshrc, .zprofile) on macOS which attackers use to execute malicious commands every time a shell session starts.

Sudo Credential Caching Abuse

Detects abuse of sudo credential caching on macOS including timestamp manipulation, sudoers file modifications to extend timeout, and tty_tickets bypass attempts.

Suspicious Browser Child Process on macOS

Detects web browsers (Safari, Chrome, Firefox) spawning suspicious child processes such as bash, curl, wget, python, or osascript. This behavior indicates potential browser exploitation, drive-by download, or malicious content execution. Legitimate browsers rarely spawn shell interpreters or download utilities directly.

Suspicious Kernel Extension Loading Detected

Detects suspicious or unauthorized kernel extension (kext) loading attempts that could indicate rootkit installation or system compromise. This rule monitors for kext loading activities that bypass normal security protections, involve unsigned or invalid extensions, or occur in sensitive system directories.

Suspicious Office Application Child Process on macOS

Detects Microsoft Office applications (Word, Excel, PowerPoint) spawning suspicious child processes such as bash, curl, wget, python, or osascript on macOS. This strongly indicates macro-based malware or document exploitation, as Office applications should not normally spawn shell interpreters or download utilities.

System Integrity Protection (SIP) Bypass Attempt

Detects attempts to bypass System Integrity Protection (SIP) through unauthorized modifications to protected locations or suspicious kernel extension loading with rootless entitlements. SIP is a critical security mechanism in macOS that protects system files and processes from modification, even by privileged users.

TCC Database Manipulation Detected

Detects unauthorized attempts to manipulate the Transparency, Consent, and Control (TCC) database to bypass privacy protections and gain access to protected resources. This detection identifies various methods of TCC database manipulation including direct database modifications, unauthorized access attempts, and privilege escalation through TCC bypass techniques.

Time Machine Backup Deletion Detected

Detects the use of tmutil to delete Time Machine backups on macOS. This is a common ransomware preparation technique where attackers delete backups to prevent recovery after encryption. Legitimate backup deletions are rare and should be closely monitored.

User Added to Admin Group via dscl

Detects the use of dscl to add a user to the admin group on macOS. This is a privilege escalation technique where attackers grant themselves or a compromised account administrative privileges to gain elevated access to the system.

WizardUpdate Malware Indicators Detected

Detects indicators of the WizardUpdate (UpdateAgent) macOS trojan. This malware uses curl piped to bash/eval patterns and references characteristic paths like intermediate_agent for staging and execution. WizardUpdate is a known macOS trojan that downloads and executes additional payloads.

XCSSET Malware Indicators Detected

Detects indicators of XCSSET malware on macOS. XCSSET is a sophisticated malware that targets Xcode projects, steals browser data, and installs backdoors. Key indicators include curl requests to /sys/log.php C2 endpoints, osacompile commands in Library/Group Containers paths, and characteristic repl staging patterns.

XProtect Evasion or Tampering Detected

Detects attempts to evade or tamper with XProtect malware detection including modification of XProtect files, databases, or YARA rules. XProtect is Apple's built-in antimalware system, and attempts to bypass or disable it indicate potential malicious activity.

macOS Cron Job Persistence

Detects crontab modifications on macOS systems. Although cron is deprecated on macOS in favor of launchd, attackers still use it for persistence as it is less commonly monitored.

macOS Ransomware Indicators

Detects mass file encryption patterns on macOS that may indicate ransomware activity, including rapid file modifications with suspicious extensions and encryption tool usage.

macOS Root Account Enabled

Detects the execution of dsenableroot to enable the root account on macOS. The root account is disabled by default on macOS for security. Enabling it grants the highest level of system privileges and is commonly done by attackers for privilege escalation and persistent elevated access.

macOS Security Tools Disabled

Detects attempts to disable or unload macOS security tools using launchctl or spctl. Attackers commonly disable endpoint security products such as LuLu, BlockBlock, Santa, CarbonBlack, CrowdStrike, and osquery, or disable Gatekeeper via spctl to execute malicious payloads without detection.

macOS System Log Clearing Detected

Detects attempts to clear or delete macOS system logs using rm, unlink, or shred commands targeting /var/log or ~/Library/Logs directories. Attackers clear logs to remove evidence of their activities and hinder forensic investigation.