deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: System Network Discovery - Linux
Repository: SigmaHQ/sigma
Severity: informational
Status: test
Author: Ömer Günal and remotephone, oscd.community
Date: 2020-10-06
ATT&CK techniques: T1016
Log source: linux/process_creation

Description:
Detects enumeration of local network configuration

Detection logic:
{
  "selection_img": {
    "Image|endswith": [
      "/firewall-cmd",
      "/ufw",
      "/iptables",
      "/netstat",
      "/ss",
      "/ip",
      "/ifconfig",
      "/systemd-resolve",
      "/route"
    ]
  },
  "selection_cli": {
    "CommandLine|contains": "/etc/resolv.conf"
  },
  "condition": "1 of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1016/T1016.md
Sigma Detection Rule: Linux Doas Tool Execution
Repository: SigmaHQ/sigma
Severity: low
Status: stable
Author: Sittikorn S, Teoderick Contreras
Date: 2022-01-20
ATT&CK techniques: T1548
Log source: linux/process_creation

Description:
Detects the doas tool execution in linux host platform. This utility tool allow standard users to perform tasks as root, the same way sudo does.

Detection logic:
{
  "selection": {
    "Image|endswith": "/doas"
  },
  "condition": "selection"
}

References:
  - https://research.splunk.com/endpoint/linux_doas_tool_execution/
  - https://www.makeuseof.com/how-to-install-and-use-doas/
Sigma Detection Rule: Print History File Contents
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-06-20
ATT&CK techniques: T1592.004
Log source: linux/process_creation

Description:
Detects events in which someone prints the contents of history files to the commandline or redirects it to a file for reconnaissance

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "/cat",
      "/head",
      "/tail",
      "/more"
    ]
  },
  "selection_history": [
    {
      "CommandLine|contains": [
        "/.bash_history",
        "/.zsh_history"
      ]
    },
    {
      "CommandLine|endswith": [
        "_history",
        ".history",
        "zhistory"
      ]
    }
  ],
  "condition": "all of selection*"
}

References:
  - https://github.com/sleventyeleven/linuxprivchecker/
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.003/T1552.003.md
Sigma Detection Rule: Remote Access Tool - Team Viewer Session Started On Linux Host
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Josh Nickels, Qi Nan
Date: 2024-03-11
ATT&CK techniques: T1133
Log source: linux/process_creation

Description:
Detects the command line executed when TeamViewer starts a session started by a remote host.
Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.


Detection logic:
{
  "selection": {
    "ParentImage|endswith": "/TeamViewer_Service",
    "Image|endswith": "/TeamViewer_Desktop",
    "CommandLine|endswith": "/TeamViewer_Desktop --IPCport 5939 --Module 1"
  },
  "condition": "selection"
}

References:
  - Internal Research
Sigma Detection Rule: New Cron File Created
Repository: SigmaHQ/sigma
Severity: low
Status: experimental
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
Date: 2021-10-15
ATT&CK techniques: T1053.003
Log source: linux/file_event

Description:
Detects the creation of cron files in Cron directories, which could indicate potential persistence mechanisms being established by an attacker.
Note that not all cron file creations are malicious - legitimate system administration activities and software installations may also create cron files.
This detection should be investigated in context, considering factors such as the user creating the file, the timing of creation, and the contents of the cron job.
Focus investigation on unexpected cron files created by non-administrative users or during suspicious timeframes.
Additionally, it is recommended to review the contents of the newly created cron files to assess their intent.
Furthermore, it is suggested to baseline normal cron file creation and apply additional filters to reduce false positives based on the specific environment.


Detection logic:
{
  "selection_cron_dirs": {
    "TargetFilename|startswith": [
      "/etc/cron.d/",
      "/etc/cron.daily/",
      "/etc/cron.hourly/",
      "/etc/cron.monthly/",
      "/etc/cron.weekly/",
      "/var/spool/cron/crontabs/",
      "/var/spool/cron/root"
    ]
  },
  "selection_cron_special_files": {
    "TargetFilename|contains": [
      "/etc/cron.allow",
      "/etc/cron.deny",
      "/etc/crontab"
    ]
  },
  "filter_optional_legit_cron": {
    "TargetFilename": [
      "/etc/cron.daily/apt",
      "/etc/cron.daily/dpkg",
      "/etc/cron.daily/passwd",
      "/etc/crontabs/root"
    ]
  },
  "condition": "1 of selection_* and not 1 of filter_optional_*"
}

References:
  - https://github.com/microsoft/MSTIC-Sysmon/blob/f1477c0512b0747c[PII_REDACTED]c21faec758e29d/linux/configs/attack-based/persistence/T1053.003_Cron_Activity.xml
  - https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/
  - https://www.elastic.co/security-labs/primer-on-persistence-mechanisms
  - https://snehbavarva.medium.com/privilege-escalation-techniques-series-linux-cron-jobs-a5b797b424b4
Sigma Detection Rule: Wget Creating Files in Tmp Directory
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
Date: 2023-06-02
ATT&CK techniques: T1105
Log source: linux/file_event

Description:
Detects the use of wget to download content in a temporary directory such as "/tmp" or "/var/tmp"

Detection logic:
{
  "selection": {
    "Image|endswith": "/wget",
    "TargetFilename|startswith": [
      "/tmp/",
      "/var/tmp/"
    ]
  },
  "condition": "selection"
}

References:
  - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html
  - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/
  - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection
  - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection
Sigma Detection Rule: Persistence Via Sudoers.d Files
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-05
ATT&CK techniques: T1548.003
Log source: linux/file_event

Description:
Detects the creation or modification of files within the "sudoers.d" directory on Linux systems.
Such activity may indicate an attempt to establish or maintain privilege escalation by granting specific users elevated permissions.
Unauthorized changes to sudoers files are a common technique used by attackers to persist administrative access.


Detection logic:
{
  "selection": {
    "TargetFilename|startswith": "/etc/sudoers.d/"
  },
  "filter_main_dpkg": {
    "Image|endswith": "/usr/bin/dpkg",
    "TargetFilename": "/etc/sudoers.d/README.dpkg-new"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://github.com/h3xduck/TripleCross/blob/1f1c3e0958af8ad9f6ebe10ab442e75de33e91de/apps/deployer.sh
Sigma Detection Rule: Suspicious Filename with Embedded Base64 Commands
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: @kostastsale
Date: 2025-11-22
ATT&CK techniques: T1059.004, T1027
Log source: linux/file_event

Description:
Detects files with specially crafted filenames that embed Base64-encoded bash payloads designed to execute when processed by shell scripts.
These filenames exploit shell interpretation quirks to trigger hidden commands, a technique observed in VShell malware campaigns.


Detection logic:
{
  "selection": {
    "TargetFilename|contains": [
      "{echo",
      "{base64,-d}"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.trellix.com/blogs/research/the-silent-fileless-threat-of-vshell/
Sigma Detection Rule: Linux Doas Conf File Creation
Repository: SigmaHQ/sigma
Severity: medium
Status: stable
Author: Sittikorn S, Teoderick Contreras
Date: 2022-01-20
ATT&CK techniques: T1548
Log source: linux/file_event

Description:
Detects the creation of doas.conf file in linux host platform.

Detection logic:
{
  "selection": {
    "TargetFilename|endswith": "/etc/doas.conf"
  },
  "condition": "selection"
}

References:
  - https://research.splunk.com/endpoint/linux_doas_conf_file_creation/
  - https://www.makeuseof.com/how-to-install-and-use-doas/
Sigma Detection Rule: Potentially Suspicious Shell Script Creation in Profile Folder
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
Date: 2023-06-02
Log source: linux/file_event

Description:
Detects the creation of shell scripts under the "profile.d" path.

Detection logic:
{
  "selection": {
    "TargetFilename|contains": "/etc/profile.d/",
    "TargetFilename|endswith": [
      ".csh",
      ".sh"
    ]
  },
  "condition": "selection"
}

References:
  - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html
  - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/
  - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection
  - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection
Sigma Detection Rule: Triple Cross eBPF Rootkit Default LockFile
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-05
Log source: linux/file_event

Description:
Detects the creation of the file "rootlog" which is used by the TripleCross rootkit as a way to check if the backdoor is already running.

Detection logic:
{
  "selection": {
    "TargetFilename": "/tmp/rootlog"
  },
  "condition": "selection"
}

References:
  - https://github.com/h3xduck/TripleCross/blob/1f1c3e0958af8ad9f6ebe10ab442e75de33e91de/src/helpers/execve_hijack.c#L33
Sigma Detection Rule: Triple Cross eBPF Rootkit Default Persistence
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-05
ATT&CK techniques: T1053.003
Log source: linux/file_event

Description:
Detects the creation of "ebpfbackdoor" files in both "cron.d" and "sudoers.d" directories. Which both are related to the TripleCross persistence method

Detection logic:
{
  "selection": {
    "TargetFilename|endswith": "ebpfbackdoor"
  },
  "condition": "selection"
}

References:
  - https://github.com/h3xduck/TripleCross/blob/12629558b8b0a27a5488a0b98f1ea7042e76f8ab/apps/deployer.sh
Sigma Detection Rule: Network Sniffing - MacOs
Repository: SigmaHQ/sigma
Severity: informational
Status: test
Author: Alejandro Ortuno, oscd.community
Date: 2020-10-14
ATT&CK techniques: T1040
Log source: macos/process_creation

Description:
Detects the usage of tooling to sniff network traffic.
An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.


Detection logic:
{
  "selection": {
    "Image|endswith": [
      "/tcpdump",
      "/tshark"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1040/T1040.md
Sigma Detection Rule: Suspicious Browser Child Process - MacOS
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Sohan G (D4rkCiph3r)
Date: 2023-04-05
ATT&CK techniques: T1189, T1203, T1059
Log source: macos/process_creation

Description:
Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.

Detection logic:
{
  "selection": {
    "ParentImage|contains": [
      "com.apple.WebKit.WebContent",
      "firefox",
      "Google Chrome Helper",
      "Google Chrome",
      "Microsoft Edge",
      "Opera",
      "Safari",
      "Tor Browser"
    ],
    "Image|endswith": [
      "/bash",
      "/curl",
      "/dash",
      "/ksh",
      "/osascript",
      "/perl",
      "/php",
      "/pwsh",
      "/python",
      "/sh",
      "/tcsh",
      "/wget",
      "/zsh"
    ]
  },
  "filter_main_generic": {
    "CommandLine|contains": "--defaults-torrc"
  },
  "filter_main_ms_autoupdate": {
    "CommandLine|contains": "/Library/Application Support/Microsoft/MAU*/Microsoft AutoUpdate.app/Contents/MacOS/msupdate"
  },
  "filter_main_chrome": {
    "ParentImage|contains": [
      "Google Chrome Helper",
      "Google Chrome"
    ],
    "CommandLine|contains": [
      "/Volumes/Google Chrome/Google Chrome.app/Contents/Frameworks/*/Resources/install.sh",
      "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/*/Resources/keystone_promote_preflight.sh",
      "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/*/Resources/keystone_promote_postflight.sh"
    ]
  },
  "filter_main_ms_edge": {
    "ParentImage|contains": "Microsoft Edge",
    "CommandLine|contains": [
      "IOPlatformExpertDevice",
      "hw.model"
    ]
  },
  "filter_main_chromerecovery": {
    "ParentImage|contains": [
      "Google Chrome Helper",
      "Goog

References:
  - https://fr.slideshare.net/codeblue_jp/cb19-recent-apt-attack-on-crypto-exchange-employees-by-heungsoo-kang
  - https://github.com/elastic/detection-rules/blob/4312d8c9583be524578a14fe6295c3370b9a9307/rules/macos/execution_initial_access_suspicious_browser_childproc.toml
Sigma Detection Rule: Potential Base64 Decoded From Images
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
Date: 2023-12-20
ATT&CK techniques: T1140
Log source: macos/process_creation

Description:
Detects the use of tail to extract bytes at an offset from an image and then decode the base64 value to create a new file with the decoded content. The detected execution is a bash one-liner.


Detection logic:
{
  "selection_image": {
    "Image|endswith": "/bash"
  },
  "selection_view": {
    "CommandLine|contains|all": [
      "tail",
      "-c"
    ]
  },
  "selection_b64": {
    "CommandLine|contains|all": [
      "base64",
      "-d",
      ">"
    ]
  },
  "selection_files": {
    "CommandLine|contains": [
      ".avif",
      ".gif",
      ".jfif",
      ".jpeg",
      ".jpg",
      ".pjp",
      ".pjpeg",
      ".png",
      ".svg",
      ".webp"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.virustotal.com/gui/file/16bafdf741e7a13137c489f3c8db1334f171c7cb13b62617d691b0a64783cc48/behavior
  - https://www.virustotal.com/gui/file/483fafc64a2b84197e1ef6a3f51e443f84dc5742602e08b9e8ec6ad690b34ed0/behavior
Sigma Detection Rule: Security Software Discovery - MacOs
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Daniil Yugoslavskiy, oscd.community
Date: 2020-10-19
ATT&CK techniques: T1518.001
Log source: macos/process_creation

Description:
Detects usage of system utilities (only grep for now) to discover security software discovery

Detection logic:
{
  "image": {
    "Image": "/usr/bin/grep"
  },
  "selection_cli_1": {
    "CommandLine|contains": [
      "nessusd",
      "santad",
      "CbDefense",
      "falcond",
      "td-agent",
      "packetbeat",
      "filebeat",
      "auditbeat",
      "osqueryd",
      "BlockBlock",
      "LuLu"
    ]
  },
  "selection_cli_2": {
    "CommandLine|contains|all": [
      "Little",
      "Snitch"
    ]
  },
  "condition": "image and 1 of selection_cli_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518.001/T1518.001.md
Sigma Detection Rule: Osacompile Execution By Potentially Suspicious Applet/Osascript
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Sohan G (D4rkCiph3r), Red Canary (Idea)
Date: 2023-04-03
ATT&CK techniques: T1059.002
Log source: macos/process_creation

Description:
Detects potential suspicious applet or osascript executing "osacompile".

Detection logic:
{
  "selection": {
    "ParentImage|endswith": [
      "/applet",
      "/osascript"
    ],
    "CommandLine|contains": "osacompile"
  },
  "condition": "selection"
}

References:
  - https://redcanary.com/blog/mac-application-bundles/
Sigma Detection Rule: Disk Image Creation Via Hdiutil - MacOS
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Omar Khaled (@beacon_exe)
Date: 2024-08-10
Log source: macos/process_creation

Description:
Detects the execution of the hdiutil utility in order to create a disk image.

Detection logic:
{
  "selection": {
    "Image|endswith": "/hdiutil",
    "CommandLine|contains": "create"
  },
  "condition": "selection"
}

References:
  - https://www.loobins.io/binaries/hdiutil/
  - https://www.sentinelone.com/blog/from-the-front-linesunsigned-macos-orat-malware-gambles-for-the-win/
  - https://ss64.com/mac/hdiutil.html
Sigma Detection Rule: Suspicious MacOS Firmware Activity
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-09-30
Log source: macos/process_creation

Description:
Detects when a user manipulates with Firmward Password on MacOS. NOTE - this command has been disabled on silicon-based apple computers.

Detection logic:
{
  "selection1": {
    "Image": "/usr/sbin/firmwarepasswd",
    "CommandLine|contains": [
      "setpasswd",
      "full",
      "delete",
      "check"
    ]
  },
  "condition": "selection1"
}

References:
  - https://github.com/usnistgov/macos_security/blob/932a51f3e819dd3e02ebfcf3ef433cfffafbe28b/rules/os/os_firmware_password_require.yaml
  - https://www.manpagez.com/man/8/firmwarepasswd/
  - https://support.apple.com/guide/security/firmware-password-protection-sec28382c9ca/web
Sigma Detection Rule: Creation Of A Local User Account
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Alejandro Ortuno, oscd.community
Date: 2020-10-06
ATT&CK techniques: T1136.001
Log source: macos/process_creation

Description:
Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.

Detection logic:
{
  "selection_dscl": {
    "Image|endswith": "/dscl",
    "CommandLine|contains": "create"
  },
  "selection_sysadminctl": {
    "Image|endswith": "/sysadminctl",
    "CommandLine|contains": "addUser"
  },
  "condition": "1 of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1136.001/T1136.001.md
  - https://ss64.com/osx/sysadminctl.html
Sigma Detection Rule: OSACompile Run-Only Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Sohan G (D4rkCiph3r)
Date: 2023-01-31
ATT&CK techniques: T1059.002
Log source: macos/process_creation

Description:
Detects potential suspicious run-only executions compiled using OSACompile

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "osacompile",
      " -x ",
      " -e "
    ]
  },
  "condition": "selection"
}

References:
  - https://redcanary.com/blog/applescript/
  - https://ss64.com/osx/osacompile.html
Sigma Detection Rule: Local System Accounts Discovery - MacOs
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Alejandro Ortuno, oscd.community
Date: 2020-10-08
ATT&CK techniques: T1087.001
Log source: macos/process_creation

Description:
Detects enumeration of local systeam accounts on MacOS

Detection logic:
{
  "selection_1": {
    "Image|endswith": "/dscl",
    "CommandLine|contains|all": [
      "list",
      "/users"
    ]
  },
  "selection_2": {
    "Image|endswith": "/dscacheutil",
    "CommandLine|contains|all": [
      "-q",
      "user"
    ]
  },
  "selection_3": {
    "CommandLine|contains": "'x:0:'"
  },
  "selection_4": {
    "Image|endswith": "/cat",
    "CommandLine|contains": [
      "/etc/passwd",
      "/etc/sudoers"
    ]
  },
  "selection_5": {
    "Image|endswith": "/id"
  },
  "selection_6": {
    "Image|endswith": "/lsof",
    "CommandLine|contains": "-u"
  },
  "condition": "1 of selection*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1087.001/T1087.001.md
Sigma Detection Rule: MacOS Network Service Scanning
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Alejandro Ortuno, oscd.community
Date: 2020-10-21
ATT&CK techniques: T1046
Log source: macos/process_creation

Description:
Detects enumeration of local or remote network services.

Detection logic:
{
  "selection_1": {
    "Image|endswith": [
      "/nc",
      "/netcat"
    ]
  },
  "selection_2": {
    "Image|endswith": [
      "/nmap",
      "/telnet"
    ]
  },
  "filter": {
    "CommandLine|contains": "l"
  },
  "condition": "(selection_1 and not filter) or selection_2"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md
Sigma Detection Rule: Scheduled Cron Task/Job - MacOs
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Alejandro Ortuno, oscd.community
Date: 2020-10-06
ATT&CK techniques: T1053.003
Log source: macos/process_creation

Description:
Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detection will focus on crontab jobs uploaded from the tmp folder.

Detection logic:
{
  "selection": {
    "Image|endswith": "/crontab",
    "CommandLine|contains": "/tmp/"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.003/T1053.003.md
Sigma Detection Rule: GUI Input Capture - macOS
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: remotephone, oscd.community
Date: 2020-10-13
ATT&CK techniques: T1056.002
Log source: macos/process_creation

Description:
Detects attempts to use system dialog prompts to capture user credentials

Detection logic:
{
  "selection_img": {
    "Image|endswith": "/osascript"
  },
  "selection_cli_1": {
    "CommandLine|contains|all": [
      "-e",
      "display",
      "dialog",
      "answer"
    ]
  },
  "selection_cli_2": {
    "CommandLine|contains": [
      "admin",
      "administrator",
      "authenticate",
      "authentication",
      "credentials",
      "pass",
      "password",
      "unlock"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.002/T1056.002.md
  - https://scriptingosx.com/2018/08/user-interaction-from-bash-scripts/
Sigma Detection Rule: Credentials from Password Stores - Keychain
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Tim Ismilyaev, oscd.community, Florian Roth (Nextron Systems)
Date: 2020-10-19
ATT&CK techniques: T1555.001
Log source: macos/process_creation

Description:
Detects passwords dumps from Keychain

Detection logic:
{
  "selection1": {
    "Image": "/usr/bin/security",
    "CommandLine|contains": [
      "find-certificate",
      " export "
    ]
  },
  "selection2": {
    "CommandLine|contains": [
      " dump-keychain ",
      " login-keychain "
    ]
  },
  "condition": "1 of selection*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1555.001/T1555.001.md
  - https://gist.github.com/Capybara/6228955