1200KM / tag
macos — logsource-product tag
63 related reference pages for logsource-product: macos.
Meaning and evidence boundary
Navigation membership is based on explicit metadata in this pinned module, not a claim of detection effectiveness or live validation.
Related pages
- Binary Padding - MacOS · sigma-rule
- Clipboard Access Via OSAScript · sigma-rule
- Creation Of A Local User Account · sigma-rule
- Credentials from Password Stores - Keychain · sigma-rule
- Credentials In Files · sigma-rule
- Decode Base64 Encoded Text -MacOs · sigma-rule
- Disable Security Tools · sigma-rule
- Disk Image Mounting Via Hdiutil - MacOS · sigma-rule
- File and Directory Discovery - MacOS · sigma-rule
- File Download Via Nscurl - MacOS · sigma-rule
- File Time Attribute Change · sigma-rule
- Gatekeeper Bypass via Xattr · sigma-rule
- Guest Account Enabled Via Sysadminctl · sigma-rule
- GUI Input Capture - macOS · sigma-rule
- Hidden Flag Set On File/Directory Via Chflags - MacOS · sigma-rule
- Hidden User Creation · sigma-rule
- Indicator Removal on Host - Clear Mac System Logs · sigma-rule
- JXA In-memory Execution Via OSAScript · sigma-rule
- Launch Agent/Daemon Execution Via Launchctl · sigma-rule
- Local Groups Discovery - MacOs · sigma-rule
- Local System Accounts Discovery - MacOs · sigma-rule
- MacOS Emond Launch Daemon · sigma-rule
- MacOS Network Service Scanning · sigma-rule
- Macos Remote System Discovery · sigma-rule
- MacOS Scripting Interpreter AppleScript · sigma-rule
- Network Sniffing - MacOs · sigma-rule
- New File Exclusion Added To Time Machine Via Tmutil - MacOS · sigma-rule
- Osacompile Execution By Potentially Suspicious Applet/Osascript · sigma-rule
- OSACompile Run-Only Execution · sigma-rule
- Payload Decoded and Decrypted via Built-in Utilities · sigma-rule
- Potential Base64 Decoded From Images · sigma-rule
- Potential Discovery Activity Using Find - MacOS · sigma-rule
- Potential In-Memory Download And Compile Of Payloads · sigma-rule
- Potential Persistence Via PlistBuddy · sigma-rule
- Remote Access Tool - Potential MeshAgent Execution - MacOS · sigma-rule
- Remote Access Tool - Renamed MeshAgent Execution - MacOS · sigma-rule
- Remote Access Tool - Team Viewer Session Started On MacOS Host · sigma-rule
- Root Account Enable Via Dsenableroot · sigma-rule
- Scheduled Cron Task/Job - MacOs · sigma-rule
- Screen Capture - macOS · sigma-rule
- Security Software Discovery - MacOs · sigma-rule
- Space After Filename - macOS · sigma-rule
- Split A File Into Pieces · sigma-rule
- Startup Item File Created - MacOS · sigma-rule
- Suspicious Browser Child Process - MacOS · sigma-rule
- Suspicious Execution via macOS Script Editor · sigma-rule
- Suspicious History File Operations · sigma-rule
- Suspicious Installer Package Child Process · sigma-rule
- Suspicious Microsoft Office Child Process - MacOS · sigma-rule
- System Information Discovery Using Ioreg · sigma-rule
- System Information Discovery Using sw_vers · sigma-rule
- System Information Discovery Using System_Profiler · sigma-rule
- System Information Discovery Via Sysctl - MacOS · sigma-rule
- System Integrity Protection (SIP) Disabled · sigma-rule
- System Integrity Protection (SIP) Enumeration · sigma-rule
- System Network Connections Discovery - MacOs · sigma-rule
- System Network Discovery - macOS · sigma-rule
- System Shutdown/Reboot - MacOs · sigma-rule
- Time Machine Backup Deletion Attempt Via Tmutil - MacOS · sigma-rule
- Time Machine Backup Disabled Via Tmutil - MacOS · sigma-rule
- User Added To Admin Group Via Dscl · sigma-rule
- User Added To Admin Group Via DseditGroup · sigma-rule
- User Added To Admin Group Via Sysadminctl · sigma-rule
Connected ecosystem references
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.