admin/elastic-detection-rules
1
0
Fork 0
mirror of https://github.com/elastic/detection-rules synced 2026-06-08 14:00:08 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
ceed26ddbcd83a5486ea9cde86b2e3ecb610edf1
elastic-detection-rules/rules/macos
T
History
litemars b68487a7b9 [Rule Tuning] Reducing FP and adding detection gap in rule Dumping Account Hashes via Built-In Commands (#6187) 
* fine_tuning_rule

---------

Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>
Co-authored-by: eric-forte-elastic <eric.forte@elastic.co>

(cherry picked from commit 4d25d522eb)
2026-05-26 18:22:33 +00:00
..
collection_discovery_output_written_to_suspicious_file.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
collection_pbpaste_execution_via_unusual_parent.toml
[New] Endpoint Rule Conversion PR (#5658)
2026-02-06 16:56:57 +00:00
collection_sensitive_file_access_followed_by_compression.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
command_and_control_aws_s3_connection_via_script.toml
[Rule Tuning] Suspicious AWS S3 Connection via Script Interpreter (#6165)
2026-05-25 06:37:54 +00:00
command_and_control_executable_download_via_wget.toml
Monthly Manifest and Schema Updation (#5697)
2026-02-10 03:50:26 +00:00
command_and_control_google_calendar_c2_via_script.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
command_and_control_network_connection_to_oast_domain.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
command_and_control_perl_outbound_network_connection.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
command_and_control_potential_etherhiding_c2.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
command_and_control_script_interpreter_connection_to_non_standard_port.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
command_and_control_suspicious_curl_from_macos_application.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
command_and_control_suspicious_curl_to_google_app_script.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
command_and_control_suspicious_outbound_network_via_unsigned_binary.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
command_and_control_unusual_connection_to_suspicious_top_level_domain.toml
Add investigation guides (#4600)
2025-04-07 20:55:39 +05:30
command_and_control_unusual_network_connection_to_suspicious_web_service.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
credential_access_credentials_keychains.toml
[Tuning] MacOS DR Tuning PR (#4546)
2025-04-21 17:32:05 -05:00
credential_access_dumping_hashes_bi_cmds.toml
[Rule Tuning] Reducing FP and adding detection gap in rule Dumping Account Hashes via Built-In Commands (#6187)
2026-05-26 18:22:33 +00:00
credential_access_dumping_keychain_security.toml
[Tuning] MacOS DR Tuning PR (#4546)
2025-04-21 17:32:05 -05:00
credential_access_high_volume_of_pbpaste.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
credential_access_kerberosdump_kcc.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
credential_access_keychain_pwd_retrieval_security_cmd.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
credential_access_mitm_localhost_webproxy.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
credential_access_potential_macos_ssh_bruteforce.toml
[Rule Tuning] Potential macOS SSH Brute Force Detected (#6161)
2026-05-18 08:52:00 +00:00
credential_access_promt_for_pwd_via_osascript.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
credential_access_python_sensitive_file_access_first_occurrence.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
credential_access_suspicious_web_browser_sensitive_file_access.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
credential_access_systemkey_dumping.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
defense_evasion_apple_softupdates_modification.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
defense_evasion_attempt_del_quarantine_attrib.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
defense_evasion_attempt_to_disable_gatekeeper.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
defense_evasion_dylib_injection_via_env_vars.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
defense_evasion_gatekeeper_override_and_execution.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
defense_evasion_install_root_certificate.toml
[Tuning] MacOS DR Tuning PR (#4546)
2025-04-21 17:32:05 -05:00
defense_evasion_modify_environment_launchctl.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
defense_evasion_privacy_controls_tcc_database_modification.toml
[Bug] comparison bug in rule Potential Privacy Control Bypass via TCCDB Modification (#6188)
2026-05-26 07:44:42 +00:00
defense_evasion_privilege_escalation_privacy_pref_sshd_fulldiskaccess.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
defense_evasion_safari_config_change.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
defense_evasion_sandboxed_office_app_suspicious_zip_file.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
defense_evasion_suspicious_tcc_access_granted.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
defense_evasion_tcc_bypass_mounted_apfs_access.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
defense_evasion_unload_endpointsecurity_kext.toml
MacOS detection rules tuning (#5667)
2026-02-05 17:23:14 +00:00
discovery_dns_request_for_ip_lookup_service.toml
[Rule Tuning] DNS Request for IP Lookup Service via Unsigned Binary (#6106)
2026-05-08 14:29:48 +00:00
discovery_external_ip_address_discovery_via_curl.toml
Monthly Manifest and Schema Updation (#5697)
2026-02-10 03:50:26 +00:00
discovery_full_disk_access_check.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
discovery_suspicious_sip_check.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
discovery_system_and_network_configuration_check.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
discovery_users_domain_built_in_commands.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
execution_defense_evasion_electron_app_childproc_node_js.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
execution_initial_access_suspicious_browser_childproc.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
execution_installer_package_spawned_network_event.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
execution_python_shell_spawn_first_occurrence.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
execution_script_via_automator_workflows.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
execution_scripting_osascript_exec_followed_by_netcon.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
execution_shell_execution_via_apple_scripting.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
execution_unusual_library_load_via_python.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
initial_access_suspicious_mac_ms_office_child_process.toml
[Rule Tuning] Suspicious macOS MS Office Child Process (#6101)
2026-05-11 16:10:03 +00:00
lateral_movement_credential_access_kerberos_bifrostconsole.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
lateral_movement_mounting_smb_share.toml
[Tuning] MacOS DR Tuning PR (#4546)
2025-04-21 17:32:05 -05:00
lateral_movement_remote_ssh_login_enabled.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
lateral_movement_suspicious_curl_to_jamf_endpoint.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
lateral_movement_vpn_connection_attempt.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
persistence_account_creation_hide_at_logon.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
persistence_apple_mail_rule_modification.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
persistence_creation_change_launch_agents_file.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
persistence_creation_hidden_login_item_osascript.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
persistence_credential_access_authorization_plugin_creation.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
persistence_crontab_creation.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
persistence_curl_execution_via_shell_profile.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
persistence_defense_evasion_hidden_launch_agent_deamon_logonitem_process.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
persistence_directory_services_plugins_modification.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
persistence_docker_shortcuts_plist_modification.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
persistence_emond_rules_file_creation.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
persistence_emond_rules_process_execution.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
persistence_enable_root_account.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
persistence_evasion_hidden_launch_agent_deamon_creation.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
persistence_finder_sync_plugin_pluginkit.toml
[Rule Tuning] Finder Sync Plugin Registered and Enabled
2026-05-18 12:35:58 +00:00
persistence_folder_action_scripts_runtime.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
persistence_hidden_plist_filename.toml
[New] Endpoint Rule Conversion PR (#5658)
2026-02-06 16:56:57 +00:00
persistence_login_logout_hooks_defaults.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
persistence_loginwindow_plist_modification.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
persistence_manual_chromium_extension_loading.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
persistence_modification_sublime_app_plugin_or_script.toml
[Tuning] MacOS DR Tuning PR (#4546)
2025-04-21 17:32:05 -05:00
persistence_periodic_tasks_file_modify.toml
[Rule Tuning] Fix typo in the filename of rule Potential Persistence via Periodic Tasks
2026-05-18 12:49:46 +00:00
persistence_python_launch_agent_or_daemon_creation_first_occurrence.toml
Update persistence_python_launch_agent_or_daemon_creation_first_occurrence.toml (#5937)
2026-04-08 21:14:37 +00:00
persistence_screensaver_engine_unexpected_child_process.toml
[Rule Tuning] Tighten Up Elastic Defend Indexes - MacOS (#4447)
2025-02-05 15:09:27 -03:00
persistence_screensaver_plist_file_modification.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
persistence_startup_item_plist_creation.toml
[New] Endpoint Rule Conversion PR (#5658)
2026-02-06 16:56:57 +00:00
persistence_suspicious_calendar_modification.toml
[Tuning] MacOS DR Tuning PR (#4546)
2025-04-21 17:32:05 -05:00
persistence_suspicious_file_creation_via_pkg_install_script.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
persistence_suspicious_launch_agent_or_launch_daemon.toml
[New] Endpoint Rule Conversion PR (#5658)
2026-02-06 16:56:57 +00:00
persistence_via_atom_init_file_modification.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
privilege_escalation_applescript_with_admin_privs.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
privilege_escalation_explicit_creds_via_scripting.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
privilege_escalation_exploit_adobe_acrobat_updater.toml
[Tuning] MacOS DR Tuning PR (#4546)
2025-04-21 17:32:05 -05:00
privilege_escalation_local_user_added_to_admin.toml
[Rule Tuning] Add Supplemental Mitre Mappings (#5876)
2026-04-01 14:15:58 +00:00
privilege_escalation_root_crontab_filemod.toml
[Tuning] MacOS DR Tuning PR (#4546)
2025-04-21 17:32:05 -05:00
privilege_escalation_user_added_to_admin_group.toml
[Rule Tuning] Windows Misc Tuning (#6088)
2026-05-07 13:11:51 +00:00