SSFileCopySender Executed as Root

  1[metadata]
  2creation_date = "2026/08/19"
  3integration = ["endpoint"]
  4maturity = "production"
  5updated_date = "2026/08/19"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies execution of the macOS Screen Sharing file-copy helper SSFileCopySender with root UID/GID attributes
 11(0 80). Under the native Apple authentication path this helper runs in the connecting user's context; execution as
 12root is anomalous and consistent with pre-authentication exploitation of the Screen Sharing service (CVE-2026-65400),
 13where a flawed SRP validation path lets an unauthenticated attacker reach privileged file operations. Note that the
 140/80 UID/GID pair reflects only initial exploitation attempts and can be evaded once an attacker enumerates another
 15local account. It is advisable to treat this as a tripwire and pair it with 
 16the SSFileCopyReceiver Writing to Common Persistence Locations rule coverage.
 17"""
 18from = "now-9m"
 19language = "esql"
 20license = "Elastic License v2"
 21name = "SSFileCopySender Executed as Root"
 22note = """ ## Triage and analysis
 23
 24> **Disclaimer**:
 25> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 26
 27### Investigating SSFileCopySender Executed as Root
 28
 29This detects the macOS Screen Sharing file-copy helper starting with root privileges, which is abnormal because legitimate file transfers run in the remote user’s context. That pattern matters because it strongly suggests a pre-authentication Screen Sharing exploit path that lets an unauthenticated attacker invoke privileged file operations, for example by reaching the service over the network and copying a payload into /Library/LaunchDaemons before any user logs in.
 30
 31### Possible investigation steps
 32
 33- Correlate the alert time with unified logs, firewall records, and endpoint network telemetry to identify the source IP that reached Screen Sharing and determine whether the connection came from an unexpected internal or external host.
 34- Reconstruct the 5–10 minute execution timeline around the event to capture the launch context and any follow-on activity such as shell, scripting, download, archive, permission-change, or service-management commands.
 35- Review concurrent and subsequent file activity for newly written or modified items in common staging and persistence paths such as /Library/LaunchDaemons, /Library/LaunchAgents, /Library/PrivilegedHelperTools, /Users/Shared, and temporary directories, and collect hashes for any payloads.
 36- Validate whether any legitimate remote administration or support session was expected on the host and compare that with authentication and user-session records to spot execution without a corresponding successful login or a rapid pivot to another local account.
 37- Scope for broader exploitation by confirming whether Screen Sharing or Remote Management was enabled, checking the host’s patch status for CVE-2026-65400, and searching for the same source IP or related indicators across other macOS systems.
 38
 39### False positive analysis
 40
 41- An authorized administrator may manually invoke SSFileCopySender as root during macOS Screen Sharing troubleshooting or control validation; verify the parent process is an expected local shell or maintenance script, the activity aligns with a documented change window, and there are no unexpected follow-on file writes.
 42- A lab or staging Mac used for patch verification or regression testing may intentionally exercise the Screen Sharing file-copy helper with the 0/80 arguments; verify the host’s role, confirm the timing matches approved test activity, and ensure any related network source and copied files are expected.
 43- Legacy VNC authentication runs SSFileCopySender in a root context, so root-context execution alone is expected and this rule will fire on benign legacy-VNC sessions. Treat it as a lead, not a finding and corroborate with a near-in-time "SSFileCopyReceiver Writing to Common Persistence Locations" alert on the same host before take an action.
 44
 45### Related Rules 
 46
 47- SSFileCopyReceiver Writing to Common Persistence Locations - 5773cef4-11a5-4d51-a40b-0e0a79d68432
 48
 49### Response and remediation
 50
 51- Immediately isolate the affected Mac from the network, disable Screen Sharing and Remote Management on the host, and block the identified source IP or access path while preserving relevant logs and suspicious files for follow-up analysis.
 52- Remove attacker footholds by unloading and deleting unauthorized launchd items from /Library/LaunchDaemons and /Library/LaunchAgents, removing rogue binaries from /Library/PrivilegedHelperTools, /Users/Shared, and temporary directories, and deleting any unknown local accounts or added SSH authorized_keys.
 53- Restore the system to a known-good state by reimaging the host or recovering from a trusted backup if SSFileCopySender was followed by writes to privileged locations, modified system settings, or execution of additional payloads.
 54- Escalate to incident response immediately if you confirm persistence in system-wide paths, evidence of lateral movement, tampering with security tooling, or the same Screen Sharing source interacting with any other macOS endpoints.
 55- Harden the environment by applying the vendor patch for CVE-2026-65400, disabling Screen Sharing where it is not required, restricting remote administration to approved management networks or VPN, and rotating passwords for any local or administrative accounts exposed on the host.
 56"""
 57references = [
 58    "https://www.huntress.com/blog/macos-screen-sharing-rce-patched",
 59    "https://nvd.nist.gov/vuln/detail/CVE-2026-65400",
 60    "https://support.apple.com/en-us/HT201222",
 61]
 62risk_score = 47
 63rule_id = "e54c3f36-e243-402d-9d44-8f7349eb8c88"
 64setup = """## Setup
 65
 66This rule requires data coming in from Elastic Defend.
 67
 68### Elastic Defend Integration Setup
 69Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
 70
 71#### Prerequisite Requirements:
 72- Fleet is required for Elastic Defend.
 73- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
 74
 75#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
 76- Go to the Kibana home page and click "Add integrations".
 77- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
 78- Click "Add Elastic Defend".
 79- Configure the integration name and optionally add a description.
 80- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
 81- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
 82- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
 83- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
 84For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
 85- Click "Save and Continue".
 86- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
 87For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
 88"""
 89severity = "medium"
 90tags = [
 91    "Domain: Endpoint",
 92    "OS: macOS",
 93    "Use Case: Threat Detection",
 94    "Use Case: Vulnerability",
 95    "Tactic: Initial Access",
 96    "Data Source: Elastic Defend",
 97    "Resources: Investigation Guide"
 98]
 99timestamp_override = "event.ingested"
100type = "esql"
101
102query = '''
103from logs-endpoint.events.process-* METADATA _id, _index, _version
104| WHERE host.os.type == "macos"
105    AND event.type == "start"
106    AND process.name == "SSFileCopySender"
107    AND KQL(""" process.args : "0" AND process.args : "80" """)
108| KEEP _id, _version, _index,
109    @timestamp,
110    data_stream.namespace,
111    host.name,
112    host.id,
113    user.id,
114    user.name,
115    process.name,
116    process.entity_id,
117    process.parent.name,
118    process.command_line
119| SORT @timestamp DESC
120| LIMIT 100
121'''
122
123[[rule.threat]]
124framework = "MITRE ATT&CK"
125
126[[rule.threat.technique]]
127id = "T1190"
128name = "Exploit Public-Facing Application"
129reference = "https://attack.mitre.org/techniques/T1190/"
130
131[rule.threat.tactic]
132id = "TA0001"
133name = "Initial Access"
134reference = "https://attack.mitre.org/tactics/TA0001/"
135
136[[rule.threat]]
137framework = "MITRE ATT&CK"
138
139[[rule.threat.technique]]
140id = "T1068"
141name = "Exploitation for Privilege Escalation"
142reference = "https://attack.mitre.org/techniques/T1068/"
143
144[rule.threat.tactic]
145id = "TA0004"
146name = "Privilege Escalation"
147reference = "https://attack.mitre.org/tactics/TA0004/"