Skip to content

[New] Endpoint Rule Conversion PR#5658

Merged
DefSecSentinel merged 34 commits intomainfrom
migrate
Feb 6, 2026
Merged

[New] Endpoint Rule Conversion PR#5658
DefSecSentinel merged 34 commits intomainfrom
migrate

Conversation

@DefSecSentinel
Copy link
Contributor

@DefSecSentinel DefSecSentinel commented Jan 30, 2026 •
edited by Mikaayenson
Loading

Pull Request

Issue link(s):

#4456

Summary

This PR introduces 35 new macOS detection rules migrated from endpoint to enable late-stage kill chain detection through SIEM alerting.

Strategic Rationale
This migration follows the Kill Chain & Confidence Model for macOS detection strategy:

Endpoint Rules (BLOCK): Focus on early kill chain stages (Initial Access, Execution, Defense Evasion) where immediate blocking prevents compromise
SIEM Rules (ALERT): Focus on late kill chain stages (Persistence, Discovery, Collection, C2, Lateral Movement) where alerting enables investigation of potentially compromised systems
Rules selected for SIEM migration represent behaviors that:

Occur after initial compromise and require investigation rather than blocking
Have higher false positive potential in endpoint blocking context
Provide threat hunting value through correlation with other signals
Detect post-exploitation activity where blocking would not prevent the initial compromise

@DefSecSentinel DefSecSentinel self-assigned this Jan 30, 2026
@DefSecSentinel DefSecSentinel added OS: macOS Rule: New Proposal for new rule labels Jan 30, 2026
@github-actions
Copy link
Contributor

github-actions bot commented Jan 30, 2026

Rule: New - Guidelines

These guidelines serve as a reminder set of considerations when proposing a new rule.

Documentation and Context

  • Detailed description of the rule.
  • List any new fields required in ECS/data sources.
  • Link related issues or PRs.
  • Include references.

Rule Metadata Checks

  • creation_date matches the date of creation PR initially merged.
  • min_stack_version should support the widest stack versions.
  • name and description should be descriptive and not include typos.
  • query should be inclusive, not overly exclusive, considering performance for diverse environments. Non ecs fields should be added to non-ecs-schema.json if not available in an integration.
  • min_stack_comments and min_stack_version should be included if the rule is only compatible starting from a specific stack version.
  • index pattern should be neither too specific nor too vague, ensuring it accurately matches the relevant data stream (e.g., use logs-endpoint.process-* for process data).
  • integration should align with the index. If the integration is newly introduced, ensure the manifest, schemas, and new_rule.yaml template are updated.
  • setup should include the necessary steps to configure the integration.
  • note should include any additional information (e.g. Triage and analysis investigation guides, timeline templates).
  • tags should be relevant to the threat and align/added to the EXPECTED_RULE_TAGS in the definitions.py file.
  • threat, techniques, and subtechniques should map to ATT&CK always if possible.

New BBR Rules

  • building_block_type should be included if the rule is a building block and the rule should be located in the rules_building_block folder.
  • bypass_bbr_timing should be included if adding custom lookback timing to the rule.

Testing and Validation

  • Provide evidence of testing and detecting the expected threat.
  • Check for existence of coverage to prevent duplication.

@tradebot-elastic
Copy link

tradebot-elastic commented Jan 30, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Security Software Discovery via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Virtual Machine Fingerprinting via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Node (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Python Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Plist Loaded by Launchctl from Unusual Location (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Jan 30, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Security Software Discovery via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Virtual Machine Fingerprinting via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Node (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Python Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Plist Loaded by Launchctl from Unusual Location (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Jan 30, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Plist Loaded by Launchctl from Unusual Location (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Security Software Discovery via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Virtual Machine Fingerprinting via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Python Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Node (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Jan 30, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Plist Loaded by Launchctl from Unusual Location (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Docker Outbound Connection to Suspicious Top Level Domain (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Security Software Discovery via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Virtual Machine Fingerprinting via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Python Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Node (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Jan 30, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Plist Loaded by Launchctl from Unusual Location (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Docker Outbound Connection to Suspicious Top Level Domain (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ macOS Security Software Discovery via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Virtual Machine Fingerprinting via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Python Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Node (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Jan 30, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Docker Outbound Connection to Suspicious Top Level Domain (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ macOS Security Software Discovery via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Virtual Machine Fingerprinting via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Python Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Node (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@DefSecSentinel
fix: add timestamp_override, investigation guides, and fix MITRE mapping
a6f2ed3 
- Added timestamp_override = 'event.ingested' to 15 non-sequence EQL rules
- Added '## Triage and analysis' investigation guides to 19 high-severity rules
- Fixed T1176 technique name from 'Browser Extensions' to 'Software Extensions'
@tradebot-elastic
Copy link

tradebot-elastic commented Jan 30, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Docker Outbound Connection to Suspicious Top Level Domain (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ macOS Security Software Discovery via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Virtual Machine Fingerprinting via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Python Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Node (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@DefSecSentinel
Enhance investigation guides for 19 high-severity macOS SIEM rules
179d6a4 
Enhanced investigation guides to align with existing SIEM rule format:
- Added detailed context paragraphs explaining the threat and detection logic
- Expanded investigation steps to 6-7 items with specific field references
- Enhanced false positive analysis with 4-5 items and exclusion guidance
- Added comprehensive response and remediation steps (6-7 items)

Rules enhanced:
- Defense Evasion: dylib_injection, gatekeeper_override, tcc_access
- Persistence: shell_profile, hidden_plist, chromium_extension, startup_item,
  pkg_install_script, launch_agent_daemon
- Execution: unusual_library_python
- Lateral Movement: jamf_endpoint
- Command and Control: google_calendar_c2, oast_domain, etherhiding,
  curl_from_app, curl_google_script, unsigned_binary
- Collection: pbpaste, sensitive_file_compression
@tradebot-elastic
Copy link

tradebot-elastic commented Jan 31, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Docker Outbound Connection to Suspicious Top Level Domain (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ macOS Security Software Discovery via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Virtual Machine Fingerprinting via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Python Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Node (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@DefSecSentinel
Fix investigation guide tests: add Resources tag and fix OAST title
f25175f 
- Added 'Resources: Investigation Guide' tag to all 19 rules with investigation guides
- Fixed OAST rule investigation guide title to match rule name exactly:
  'Network Connection to OAST Domain via Script Interpreter'
@tradebot-elastic
Copy link

tradebot-elastic commented Jan 31, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Docker Outbound Connection to Suspicious Top Level Domain (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ macOS Security Software Discovery via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Virtual Machine Fingerprinting via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Python Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Node (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Jan 31, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Docker Outbound Connection to Suspicious Top Level Domain (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ macOS Security Software Discovery via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Virtual Machine Fingerprinting via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Python Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Node (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Feb 4, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Security Software Discovery via Grep (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Script Interpreter Connection to Non-Standard Port (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Feb 5, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Security Software Discovery via Grep (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Script Interpreter Connection to Non-Standard Port (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Feb 5, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Security Software Discovery via Grep (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Script Interpreter Connection to Non-Standard Port (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

Samirbous
Samirbous approved these changes Feb 6, 2026
View reviewed changes
DefSecSentinel and others added 2 commits February 6, 2026 10:11
@DefSecSentinel @Samirbous
Update rules/macos/command_and_control_aws_s3_connection_via_script.toml
4ef8935 
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
@DefSecSentinel @Samirbous
Update rules/macos/command_and_control_aws_s3_connection_via_script.toml
5b56688 
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
@tradebot-elastic
Copy link

tradebot-elastic commented Feb 6, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Security Software Discovery via Grep (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Script Interpreter Connection to Non-Standard Port (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Feb 6, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Security Software Discovery via Grep (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Script Interpreter Connection to Non-Standard Port (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

DefSecSentinel and others added 2 commits February 6, 2026 10:12
@DefSecSentinel @Samirbous
Update rules/macos/command_and_control_aws_s3_connection_via_script.toml
990e67d 
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
@DefSecSentinel @Samirbous
Update rules/macos/defense_evasion_suspicious_tcc_access_granted.toml
253bc13 
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
@tradebot-elastic
Copy link

tradebot-elastic commented Feb 6, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Security Software Discovery via Grep (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Script Interpreter Connection to Non-Standard Port (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@DefSecSentinel @Samirbous
Update rules/macos/persistence_manual_chromium_extension_loading.toml
6943135 
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
@tradebot-elastic
Copy link

tradebot-elastic commented Feb 6, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Security Software Discovery via Grep (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Script Interpreter Connection to Non-Standard Port (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@DefSecSentinel @Samirbous
Update rules/macos/persistence_startup_item_plist_creation.toml
b4c78a1 
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
@tradebot-elastic
Copy link

tradebot-elastic commented Feb 6, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Security Software Discovery via Grep (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Script Interpreter Connection to Non-Standard Port (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@DefSecSentinel @Samirbous
Update rules/macos/persistence_suspicious_launch_agent_or_launch_daem…
1517f19 
…on.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
@tradebot-elastic
Copy link

tradebot-elastic commented Feb 6, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Security Software Discovery via Grep (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Script Interpreter Connection to Non-Standard Port (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@DefSecSentinel @Samirbous
Update rules/macos/persistence_suspicious_launch_agent_or_launch_daem…
0a497ee 
…on.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
@tradebot-elastic
Copy link

tradebot-elastic commented Feb 6, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Security Software Discovery via Grep (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Script Interpreter Connection to Non-Standard Port (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Feb 6, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Security Software Discovery via Grep (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Script Interpreter Connection to Non-Standard Port (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Feb 6, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Security Software Discovery via Grep (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Script Interpreter Connection to Non-Standard Port (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@DefSecSentinel @cursoragent
Fix ESQL syntax error in AWS S3 connection rule
4135182 
Remove trailing comma before BY clause in STATS command that caused a parsing_exception.

Co-authored-by: Cursor <cursoragent@cursor.com>
@tradebot-elastic
Copy link

tradebot-elastic commented Feb 6, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Security Software Discovery via Grep (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Script Interpreter Connection to Non-Standard Port (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@DefSecSentinel DefSecSentinel merged commit 43d3f3b into main Feb 6, 2026
14 checks passed
@DefSecSentinel DefSecSentinel deleted the migrate branch February 6, 2026 16:53
@DefSecSentinel DefSecSentinel mentioned this pull request Feb 7, 2026
Closed
3 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Samirbous Samirbous Samirbous approved these changes

@Aegrah Aegrah Aegrah approved these changes

@terrancedejesus terrancedejesus terrancedejesus approved these changes

@w0rk3r w0rk3r Awaiting requested review from w0rk3r

@Mikaayenson Mikaayenson Awaiting requested review from Mikaayenson

Assignees

@DefSecSentinel DefSecSentinel

Labels

backport: auto Domain: Endpoint OS: macOS Rule: New Proposal for new rule

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@DefSecSentinel @tradebot-elastic @Mikaayenson @Samirbous @Aegrah @terrancedejesus