System Network Discovery - macOS

 1title: System Network Discovery - macOS
 2id: 58800443-f9fc-4d55-ae0c-98a3966dfb97
 3status: test
 4description: Detects enumeration of local network configuration
 5references:
 6    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1016/T1016.md
 7author: remotephone, oscd.community
 8date: 2020-10-06
 9modified: 2024-08-29
10tags:
11    - attack.discovery
12    - attack.t1016
13logsource:
14    product: macos
15    category: process_creation
16detection:
17    selection_1:
18        Image|endswith:
19            - '/arp'
20            - '/ifconfig'
21            - '/netstat'
22            - '/networksetup'
23            - '/socketfilterfw'
24    selection_2:
25        Image: '/usr/bin/defaults'
26        CommandLine|contains|all:
27            - '/Library/Preferences/com.apple.alf'
28            - 'read'
29    filter_main_wifivelocityd:
30        ParentImage|endswith: '/wifivelocityd'
31    condition: 1 of selection_* and not 1 of filter_main_*
32falsepositives:
33    - Legitimate administration activities
34level: informational