Public registry · MITRE ATT&CK-mapped

Browse rules by MITRE ATT&CK

Browse governance rules by MITRE ATT&CK tactic & technique. Pick a technique to find the public rulesets whose .rules defend against it — filterable per technology.

T1546.004 Persistence

Event Triggered Execution: Unix Shell Configuration Modification

1 ruleset found
View on MITRE ATT&CK
Macos
@sigmashakeinc/rules-macos
Official Verified
Comprehensive macOS security & safety governance for AI coding agents — 44 rules spanning all 11 SSG tool-use categories: destructive operations, privilege escalation, untrusted code execution, credential & secret access, network egress, supply chain, process & system control, version-control integrity, source & config integrity, sensitive data handling, and agent hygiene. Blocks SIP/Gatekeeper bypass, keychain & credential theft, reverse shells & data exfiltration, untrusted .pkg / Homebrew installs, LaunchDaemon/Agent persistence, entitlement weakening, PII collection (Messages/Photos/Contacts), and irreversible disk / Time Machine destruction. Each rule is mapped to MITRE ATT&CK.

Protects against: Comprehensive macOS security & safety governance for AI coding agents — 44 rules spanning all 11 SSG tool-use categor…

sigmashakeinc v4 · 4 days ago 44 rules