| elastic |
Creation of Hidden Files and Directories via CommandLine |
production |
2026-10-08 |
| elastic |
Hidden File Created in System Directory by Suspicious Process |
production |
2026-10-07 |
| elastic |
Persistence via a Hidden Plist Filename via macOS Security Events |
production |
2026-10-06 |
| elastic |
Hidden Files and Directories via Hidden Flag |
production |
2026-09-18 |
| elastic |
High Number of Egress Network Connections from Unusual Executable |
production |
2026-09-18 |
| elastic |
Directory Creation in /bin directory |
production |
2026-09-18 |
| elastic |
Hidden Directory Creation via Unusual Parent |
production |
2026-09-18 |
| elastic |
Creation of Hidden Shared Object File |
production |
2026-09-18 |
| elastic |
Kill Command Execution |
production |
2026-09-18 |
| elastic |
Potential Hidden Process via Mount Hidepid |
production |
2026-09-18 |
| elastic |
File Creation in /var/log via Suspicious Process |
production |
2026-09-18 |
| elastic |
Suspicious Hidden Child Process of Launchd |
production |
2026-09-18 |
| elastic |
Creation of Hidden Launch Agent or Daemon |
production |
2026-09-18 |
| elastic |
Persistence via a Hidden Plist Filename |
production |
2026-09-18 |
| elastic |
Adding Hidden File Attribute via Attrib |
production |
2026-09-18 |
| elastic |
Potential Kubectl Masquerading via Unexpected Process |
production |
2026-09-18 |
| elastic |
Suspicious Process Execution Detected via Defend for Containers |
production |
2026-09-18 |
| splunk |
MacOS Hidden Files and Directories |
production |
2026-05-13 |
| splunk |
Disable Show Hidden Files |
production |
2026-05-13 |
| sigma |
Atomic MacOS Stealer - Persistence Indicators |
experimental |
2025-11-22 |
| sigma |
Registry Persistence via Service in Safe Mode |
test |
2025-10-22 |
| sigma |
Hidden Files and Directories |
test |
2025-06-16 |
| sigma |
Use Icacls to Hide File to Everyone |
test |
2024-04-29 |
| sigma |
Displaying Hidden Files Feature Disabled |
test |
2024-03-26 |
| sigma |
PowerShell Logging Disabled Via Registry Key Tampering |
test |
2023-08-17 |
| sigma |
Hiding Files with Attrib.exe |
test |
2023-03-14 |
| sigma |
Set Files as System Files Using Attrib.EXE |
test |
2023-03-14 |
| sigma |
Set Suspicious Files as System Files Using Attrib.EXE |
test |
2023-03-14 |