SSFileCopyReceiver Writing to Common Persistence Locations

  1[metadata]
  2creation_date = "2026/08/19"
  3integration = ["endpoint"]
  4maturity = "production"
  5updated_date = "2026/08/19"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies the macOS Screen Sharing file copy helper SSFileCopyReceiver creating or modifying files in 
 11common persistence locations, including system-wide and per-user LaunchDaemons/LaunchAgents, shell profiles, 
 12SSH authorized_keys, cron tabs, and hidden paths under root's home directory. SSFileCopyReceiver performs file writes 
 13with root authority on behalf of a remote viewer.Pre-authentication exploitation of the Screen Sharing service (CVE-2026-65400) 
 14abuses this write primitive to establish persistence; observed in-the-wild activity dropped LaunchDaemons and 
 15modified shell startup files to run a cryptocurrency miner as root.
 16"""
 17from = "now-9m"
 18language = "esql"
 19license = "Elastic License v2"
 20name = "SSFileCopyReceiver Writing to Common Persistence Locations"
 21note = """ ## Triage and analysis
 22
 23> **Disclaimer**:
 24> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 25
 26### Investigating SSFileCopyReceiver Writing to Common Persistence Locations
 27
 28This rule spots the macOS Screen Sharing file copy helper writing into locations that commonly grant persistence, such as launch items, shell startup files, SSH access files, scheduled task tabs, and hidden directories under root’s home. It matters because this helper performs writes as root for a remote session, so an attacker can exploit Screen Sharing and drop a LaunchDaemon plist or alter .zshrc to start a miner or backdoor every boot or login.
 29
 30### Possible investigation steps
 31
 32- Review the exact contents and recent versions of the written plist, shell startup file, cron tab, hidden root file, or SSH key file for persistence logic such as RunAtLoad or KeepAlive settings, embedded download commands, unexpected SSH public keys, or references to miner, shell, or staging paths.
 33- Correlate the file write time with Screen Sharing and VNC access evidence in Unified Logs, authentication records, and inbound network activity to determine whether the change aligns with an approved remote support session or an unsolicited access attempt consistent with exploitation.
 34- Confirm whether the persistence has executed by examining loaded launchd jobs, recent root-level child processes, and any binaries or scripts referenced by the modified artifact, prioritizing unknown executables, curl or bash chains, and long-running resource-intensive processes.
 35- Validate the dropped or referenced payloads by collecting hashes, code-signing and notarization status, ownership and permissions, and comparing them to known-good administration tools, approved software, and recent change tickets.
 36- Scope impact and remediate by hunting fleet-wide for the same plist labels, SSH keys, file hashes, payload paths, and Screen Sharing write patterns, then isolate affected hosts, remove unauthorized persistence, revoke added access, and update or disable exposed Screen Sharing services until patched.
 37
 38### False positive analysis
 39
 40- A legitimate administrator using macOS Screen Sharing may copy an approved LaunchDaemon or LaunchAgent plist during remote maintenance or software rollout; verify the session was expected and that the plist label, referenced executable, ownership, and signing details match authorized system changes.
 41- A user support session can legitimately update a shell profile or SSH authorized_keys file to restore access or set environment defaults; confirm the request with the user or admin and review the added commands or keys to ensure they belong to known accounts and do not launch unexpected binaries.
 42
 43### Related Rules 
 44
 45- SSFileCopySender Executed as Root - e54c3f36-e243-402d-9d44-8f7349eb8c88
 46
 47### Response and remediation
 48
 49- Isolate the affected Mac from the network, stop any malicious launchd job, miner, or shell started from the newly written LaunchDaemon, LaunchAgent, shell profile, cron tab, hidden root file, or added SSH key, and preserve the modified files and referenced payloads as evidence.
 50- Remove attacker persistence by deleting unauthorized plist files from /Library/LaunchDaemons or LaunchAgents, reverting changes to .zshrc, .bash_profile, and other startup files, removing unapproved entries from authorized_keys and /var/at/tabs, and unloading any matching launchd services.
 51- Restore the host to a known-good state by replacing altered configuration files from a trusted backup or gold image, reinstalling any trojanized binaries referenced by the persistence item, and validating ownership, permissions, and code-signing on the restored files.
 52- Escalate to incident response immediately if the same plist label, SSH public key, payload hash, or Screen Sharing write pattern is found on additional systems, if root-level processes continue after cleanup, or if you identify signs of credential theft or lateral movement.
 53- Harden the environment by patching or disabling Screen Sharing where it is not required, restricting remote management exposure with firewall and access controls, rotating credentials and SSH keys that may have been added or abused, and monitoring for new writes to LaunchDaemons, shell profiles, cron tabs, and hidden paths under root’s home.
 54"""
 55references = [
 56    "https://www.huntress.com/blog/macos-screen-sharing-rce-patched",
 57    "https://nvd.nist.gov/vuln/detail/CVE-2026-65400",
 58    "https://support.apple.com/en-us/HT201222",
 59]
 60risk_score = 73
 61rule_id = "5773cef4-11a5-4d51-a40b-0e0a79d68432"
 62setup = """## Setup
 63
 64This rule requires data coming in from Elastic Defend.
 65
 66### Elastic Defend Integration Setup
 67Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
 68
 69#### Prerequisite Requirements:
 70- Fleet is required for Elastic Defend.
 71- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
 72
 73#### The following steps should be executed in order to add the Elastic Defend integration on a macOS System:
 74- Go to the Kibana home page and click "Add integrations".
 75- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
 76- Click "Add Elastic Defend".
 77- Configure the integration name and optionally add a description.
 78- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
 79- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
 80- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
 81- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
 82For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/current/agent-policy.html).
 83- Click "Save and Continue".
 84- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
 85For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
 86"""
 87severity = "high"
 88tags = [
 89    "Domain: Endpoint",
 90    "OS: macOS",
 91    "Use Case: Threat Detection",
 92    "Use Case: Vulnerability",
 93    "Tactic: Persistence",
 94    "Data Source: Elastic Defend",
 95    "Resources: Investigation Guide"
 96]
 97timestamp_override = "event.ingested"
 98type = "esql"
 99query = '''
100from logs-endpoint.events.file-* METADATA _id, _index, _version
101| WHERE host.os.type == "macos"
102    AND event.type != "deletion"
103    AND process.name == "SSFileCopyReceiver"
104    AND (
105        file.path LIKE "/Library/LaunchDaemons/*.plist"
106        OR file.path LIKE "/Library/LaunchAgents/*.plist"
107        OR file.path LIKE "/Users/*/Library/LaunchAgents/*.plist"
108        OR file.path LIKE "/private/var/*/Library/LaunchAgents/*.plist"
109        OR file.name IN (".zshenv", ".zshrc", ".zprofile", ".zlogin", ".bashrc", ".bash_profile", ".bash_login", ".profile", "config.fish", "environment.plist")
110        OR file.path LIKE "/Users/*/.ssh/authorized_keys"
111        OR file.path LIKE "/private/var/root/.ssh/authorized_keys"
112        OR file.path LIKE "/private/etc/ssh/sshd_config*"
113        OR file.path LIKE "/private/var/at/tabs/*"
114        OR file.path LIKE "/var/at/tabs/*"
115        OR file.path LIKE "/private/var/root/.*/*"
116        OR file.path LIKE "/var/root/.*/*"
117        OR file.path LIKE "/private/var/root/.*"
118        OR file.path LIKE "/var/root/.*"
119    )
120| KEEP _id, _index, _version, 
121    @timestamp, host.name, host.id, user.id, user.name, process.name, 
122    event.action, event.type, file.path, file.name, data_stream.namespace
123'''
124
125[[rule.threat]]
126framework = "MITRE ATT&CK"
127
128[[rule.threat.technique]]
129id = "T1543"
130name = "Create or Modify System Process"
131reference = "https://attack.mitre.org/techniques/T1543/"
132
133[[rule.threat.technique.subtechnique]]
134id = "T1543.001"
135name = "Launch Agent"
136reference = "https://attack.mitre.org/techniques/T1543/001/"
137
138[[rule.threat.technique.subtechnique]]
139id = "T1543.004"
140name = "Launch Daemon"
141reference = "https://attack.mitre.org/techniques/T1543/004/"
142
143[[rule.threat.technique]]
144id = "T1546"
145name = "Event Triggered Execution"
146reference = "https://attack.mitre.org/techniques/T1546/"
147
148[[rule.threat.technique.subtechnique]]
149id = "T1546.004"
150name = "Unix Shell Configuration Modification"
151reference = "https://attack.mitre.org/techniques/T1546/004/"
152
153[[rule.threat.technique]]
154id = "T1098"
155name = "Account Manipulation"
156reference = "https://attack.mitre.org/techniques/T1098/"
157
158[[rule.threat.technique.subtechnique]]
159id = "T1098.004"
160name = "SSH Authorized Keys"
161reference = "https://attack.mitre.org/techniques/T1098/004/"
162
163[rule.threat.tactic]
164id = "TA0003"
165name = "Persistence"
166reference = "https://attack.mitre.org/tactics/TA0003/"