Detections
Detection rules from the lab, each tested against the attack it is meant to catch.
In preparation. The first rules arrive with the fourth part of Agentless macOS.
Rules
Each rule as code, with the technique it covers in MITRE ATT&CK terms.
How each rule was tested
The emulated attack that fires it, and the captured events it was checked against.
False positives
What else fires it in an ordinary working week, and how the rule tells the two apart.
Coverage map
The techniques covered on macOS, rule by rule.