macos:osquery
osquery (macOS)
Table names
- Host type
- macOS
- Cost class
- Free tool
- Techniques
- 94
- Rules listed
- 0
- Events
- 17
Licensing
- License or service
- osquery (Apache 2.0 / GPL 2.0 dual)
- What is free
- All
- What costs
- Nothing
- Vendor page
- https://github.com/osquery/osquery
- As read on
- 2026-11-01
A vendor statement as read on the date shown; the cost class is the durable part.
Techniques
- T1001.001 Junk Data
- T1001.002 Steganography
- T1001.003 Protocol or Service Impersonation
- T1003 OS Credential Dumping
- T1007 System Service Discovery
- T1010 Application Window Discovery
- T1011 Exfiltration Over Other Network Medium
- T1011.001 Exfiltration Over Bluetooth
- T1014 Rootkit
- T1018 Remote System Discovery
- T1021 Remote Services
- T1021.004 SSH
- T1021.005 VNC
- T1025 Data from Removable Media
- T1027 Obfuscated Files or Information
- T1027.003 Steganography
- T1027.004 Compile After Delivery
- T1027.005 Indicator Removal from Tools
- T1027.006 HTML Smuggling
- T1027.008 Stripped Payloads
- T1027.009 Embedded Payloads
- T1037 Boot or Logon Initialization Scripts
- T1040 Network Sniffing
- T1041 Exfiltration Over C2 Channel
- T1046 Network Service Discovery
- T1048 Exfiltration Over Alternative Protocol
- T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol
- T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
- T1049 System Network Connections Discovery
- T1052 Exfiltration Over Physical Medium
- T1052.001 Exfiltration over USB
- T1053 Scheduled Task/Job
- T1053.002 At
- T1056 Input Capture
- T1056.001 Keylogging
- T1056.002 GUI Input Capture
- T1056.004 Credential API Hooking
- T1057 Process Discovery
- T1059.004 Unix Shell
- T1059.005 Visual Basic
- T1059.006 Python
- T1059.007 JavaScript
- T1070 Indicator Removal
- T1070.006 Timestomp
- T1070.007 Clear Network Connection History and Configurations
- T1070.008 Clear Mailbox Data
- T1070.009 Clear Persistence
- T1070.010 Relocate Malware
- T1071 Application Layer Protocol
- T1071.001 Web Protocols
- T1071.002 File Transfer Protocols
- T1071.003 Mail Protocols
- T1071.005 Publish/Subscribe Protocols
- T1090.001 Internal Proxy
- T1090.002 External Proxy
- T1090.003 Multi-hop Proxy
- T1090.004 Domain Fronting
- T1102 Web Service
- T1102.001 Dead Drop Resolver
- T1111 Multi-Factor Authentication Interception
- T1120 Peripheral Device Discovery
- T1195 Supply Chain Compromise
- T1203 Exploitation for Client Execution
- T1204 User Execution
- T1204.004 Malicious Copy and Paste
- T1210 Exploitation of Remote Services
- T1211 Exploitation for Stealth
- T1212 Exploitation for Credential Access
- T1213 Data from Information Repositories
- T1217 Browser Information Discovery
- T1218 System Binary Proxy Execution
- T1218.015 Electron Applications
- T1219 Remote Access Tools
- T1499.001 OS Exhaustion Flood
- T1499.003 Application Exhaustion Flood
- T1543.001 Launch Agent
- T1547.006 Kernel Modules and Extensions
- T1553 Subvert Trust Controls
- T1553.001 Gatekeeper Bypass
- T1553.004 Install Root Certificate
- T1555.005 Password Managers
- T1556 Modify Authentication Process
- T1556.003 Pluggable Authentication Modules
- T1558.005 Ccache Files
- T1559 Inter-Process Communication
- T1565 Data Manipulation
- T1565.001 Stored Data Manipulation
- T1565.002 Transmitted Data Manipulation
- T1565.003 Runtime Data Manipulation
- T1614 System Location Discovery
- T1614.001 System Language Discovery
- T1668 Exclusive Control
- T1669 Wi-Fi Networks
Rules
No vendor rule names this event or source directly.