process_creation

Clipboard Data Collection Via OSAScript

Dec 1, 2023 · attack.collection attack.execution attack.t1115 attack.t1059.002 ·

Share on:

Detects possible collection of data from the clipboard via execution of the osascript binary

JXA In-memory Execution Via OSAScript

Dec 1, 2023 · attack.t1059.002 attack.t1059.007 attack.execution ·

Share on:

Detects possible malicious execution of JXA in-memory via OSAScript

OSACompile Run-Only Execution

Dec 1, 2023 · attack.t1059.002 attack.execution ·

Share on:

Detects potential suspicious run-only executions compiled using OSACompile

Suspicious Microsoft Office Child Process - MacOS

Dec 1, 2023 · attack.execution attack.persistence attack.t1059.002 attack.t1137.002 attack.t1204.002 ·

Share on:

Detects suspicious child processes spawning from microsoft office suite applications such as word or excel. This could indicates malicious macro execution

Potential Discovery Activity Using Find - MacOS

Nov 2, 2023 · attack.discovery attack.t1083 ·

Share on:

Detects usage of "find" binary in a suspicious manner to perform discovery

Suspicious Execution via macOS Script Editor

Nov 2, 2023 · attack.t1566 attack.t1566.002 attack.initial_access attack.t1059 attack.t1059.002 attack.t1204 attack.t1204.001 attack.execution attack.persistence attack.t1553 attack.defense_evasion ·

Share on:

Detects when the macOS Script Editor utility spawns an unusual child process.

Binary Padding - MacOS

Oct 18, 2023 · attack.defense_evasion attack.t1027.001 ·

Share on:

Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This rule detect using dd and truncate to add a junk data to file.

Macos Remote System Discovery

Oct 18, 2023 · attack.discovery attack.t1018 ·

Share on:

Detects the enumeration of other remote systems.

User Added To Admin Group Via Dscl

Oct 18, 2023 · attack.initial_access attack.privilege_escalation attack.t1078.003 ·

Share on:

Detects attempts to create and add an account to the admin group via "dscl"

User Added To Admin Group Via DseditGroup

Oct 18, 2023 · attack.initial_access attack.privilege_escalation attack.t1078.003 ·

Share on:

Detects attempts to create and/or add an account to the admin group, thus granting admin privileges.

Indicator Removal on Host - Clear Mac System Logs

Oct 17, 2023 · attack.defense_evasion attack.t1070.002 ·

Share on:

Detects deletion of local audit logs

Payload Decoded and Decrypted via Built-in Utilities

Oct 17, 2023 · attack.t1059 attack.t1204 attack.execution attack.t1140 attack.defense_evasion attack.s0482 attack.s0402 ·

Share on:

Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.

Potential WizardUpdate Malware Infection

Oct 17, 2023 · attack.command_and_control ·

Share on:

Detects the execution traces of the WizardUpdate malware. WizardUpdate is a macOS trojan that attempts to infiltrate macOS machines to steal data and it is associated with other types of malicious payloads, increasing the chances of multiple infections on a device.

Potential In-Memory Download And Compile Of Payloads

Aug 22, 2023 · attack.command_and_control attack.execution attack.t1059.007 attack.t1105 ·

Share on:

Detects potential in-memory downloading and compiling of applets using curl and osacompile as seen used by XCSSET malware

User Added To Admin Group Via Sysadminctl

Aug 22, 2023 · attack.initial_access attack.privilege_escalation attack.t1078.003 ·

Share on:

Detects attempts to create and add an account to the admin group via "sysadminctl"

JAMF MDM Potential Suspicious Child Process

Aug 22, 2023 · attack.execution ·

Share on:

Detects potential suspicious child processes of "jamf". Could be a sign of potential abuse of Jamf as a C2 server as seen by Typhon MythicAgent.

JAMF MDM Execution

Aug 22, 2023 · attack.execution ·

Share on:

Detects execution of the "jamf" binary to create user accounts and run commands. For example, the binary can be abused by attackers on the system in order to bypass security controls or remove application control polices.

Root Account Enable Via Dsenableroot

Aug 22, 2023 · attack.t1078 attack.t1078.001 attack.t1078.003 attack.initial_access attack.persistence ·

Share on:

Detects attempts to enable the root account via "dsenableroot"

Suspicious Browser Child Process - MacOS

Apr 5, 2023 · attack.initial_access attack.execution attack.t1189 attack.t1203 attack.t1059 ·

Share on:

Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.

Osacompile Execution By Potentially Suspicious Applet/Osascript

Apr 3, 2023 · attack.execution attack.t1059.002 ·

Share on:

Detects potential suspicious applet or osascript executing "osacompile".

Potential Persistence Via PlistBuddy

Feb 28, 2023 · attack.persistence attack.t1543.001 attack.t1543.004 ·

Share on:

Detects potential persistence activity using LaunchAgents or LaunchDaemons via the PlistBuddy utility

Suspicious Installer Package Child Process

Feb 21, 2023 · attack.t1059 attack.t1059.007 attack.t1071 attack.t1071.001 attack.execution attack.command_and_control ·

Share on:

Detects the execution of suspicious child processes from macOS installer package parent process. This includes osascript, JXA, curl and wget amongst other interpreters

Guest Account Enabled Via Sysadminctl

Feb 20, 2023 · attack.initial_access attack.t1078 attack.t1078.001 ·

Share on:

Detects attempts to enable the guest account using the sysadminctl utility

Creation Of A Local User Account

Feb 20, 2023 · attack.t1136.001 attack.persistence ·

Share on:

Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.

MacOS Scripting Interpreter AppleScript

Feb 1, 2023 · attack.execution attack.t1059.002 ·

Share on:

Detects execution of AppleScript of the macOS scripting language AppleScript.

Credentials from Password Stores - Keychain

Feb 1, 2023 · attack.credential_access attack.t1555.001 ·

Share on:

Detects passwords dumps from Keychain

File Time Attribute Change

Jan 12, 2023 · attack.defense_evasion attack.t1070.006 ·

Share on:

Detect file time attribute change to hide new or changes to existing files

Space After Filename - macOS

Jan 4, 2023 · attack.defense_evasion attack.t1036.006 ·

Share on:

Detects attempts to masquerade as legitimate files by adding a space to the end of the filename.

System Network Discovery - macOS

Dec 29, 2022 · attack.discovery attack.t1016 ·

Share on:

Detects enumeration of local network configuration

System Network Connections Discovery - MacOs

Dec 29, 2022 · attack.discovery attack.t1049 ·

Share on:

Detects usage of system utilities to discover system network connections

GUI Input Capture - macOS

Dec 27, 2022 · attack.credential_access attack.t1056.002 ·

Share on:

Detects attempts to use system dialog prompts to capture user credentials

Local Groups Discovery - MacOs

Nov 28, 2022 · attack.discovery attack.t1069.001 ·

Share on:

Detects enumeration of local system groups

Local System Accounts Discovery - MacOs

Nov 28, 2022 · attack.discovery attack.t1087.001 ·

Share on:

Detects enumeration of local systeam accounts on MacOS

Scheduled Cron Task/Job - MacOs

Nov 28, 2022 · attack.execution attack.persistence attack.privilege_escalation attack.t1053.003 ·

Share on:

Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detection will focus on crontab jobs uploaded from the tmp folder.

Security Software Discovery - MacOs

Nov 28, 2022 · attack.discovery attack.t1518.001 ·

Share on:

Detects usage of system utilities (only grep for now) to discover security software discovery

Decode Base64 Encoded Text -MacOs

Nov 27, 2022 · attack.defense_evasion attack.t1027 ·

Share on:

Detects usage of base64 utility to decode arbitrary base64-encoded text

Network Sniffing - MacOs

Nov 27, 2022 · attack.discovery attack.credential_access attack.t1040 ·

Share on:

Detects the usage of tooling to sniff network traffic. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.