/*
  SiftSpace starter ruleset — conservative macOS behaviour heuristics.

  Original rules, MIT licensed. They flag suspicious behaviours, not malware
  families. A match is a signal to review, not a malware verdict.
  Copyright (c) Fahid Digital Ventures LLC.
*/

rule SiftSpace_Bash_Reverse_Shell
{
    meta:
        description = "Bash reverse shell using /dev/tcp redirection"
        severity = "critical"
        author = "SiftSpace"
    strings:
        $a = /bash\s+-i\s*>&\s*\/dev\/tcp\//
        $b = ">& /dev/tcp/"
        $c = "0>&1"
    condition:
        $a or ($b and $c)
}

rule SiftSpace_Python_Reverse_Shell
{
    meta:
        description = "Python reverse-shell payload shape"
        severity = "critical"
        author = "SiftSpace"
    strings:
        $conn  = ".connect("
        $p_dup = /dup2\(\s*s\.fileno\(\)/
        $p_pty = /pty\.spawn\(\s*['"]\/bin\/(sh|bash|zsh)/
        $p_sub = /subprocess\.(call|Popen)\(\s*\[\s*['"]\/bin\/(sh|bash)['"]\s*,\s*['"]-i/
    condition:
        $conn and any of ($p_*)
}

rule SiftSpace_Obfuscated_Base64_Shell
{
    meta:
        description = "Base64-decoded payload piped directly into a shell"
        severity = "high"
        author = "SiftSpace"
    strings:
        $a = /(echo|printf)\s+[A-Za-z0-9+\/=]{40,}\s*\|\s*base64\s+-[dD]/
        $b = /base64\s+-[dD][^\n|]*\|\s*(sh|bash|zsh)\b/
    condition:
        any of them
}

rule SiftSpace_LaunchAgent_Network_Shell
{
    meta:
        description = "Launch agent or daemon with download-and-run or raw-network shell behaviour"
        severity = "high"
        author = "SiftSpace"
    strings:
        $plist = "<?xml"
        $run   = "RunAtLoad"
        $n1    = "/dev/tcp/"
        $n2    = /\bnc\s+-[a-z]*e/
        $n3    = /(curl|wget)[^\n<]{0,200}\|\s*(sh|bash|zsh)\b/
    condition:
        $plist and $run and any of ($n*)
}

rule SiftSpace_Osascript_Admin_Shell
{
    meta:
        description = "AppleScript requesting administrator privileges for a shell command"
        severity = "medium"
        author = "SiftSpace"
    strings:
        $osa = "osascript" nocase
        $do  = "do shell script" nocase
        $adm = "with administrator privileges" nocase
    condition:
        $osa and $do and $adm
}