System Network Discovery - macOS
Detects enumeration of local network configuration
Sigma rule (View on GitHub)
1title: System Network Discovery - macOS
2id: 58800443-f9fc-4d55-ae0c-98a3966dfb97
3status: test
4description: Detects enumeration of local network configuration
5references:
6 - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1016/T1016.md
7author: remotephone, oscd.community
8date: 2020/10/06
9modified: 2022/12/28
10tags:
11 - attack.discovery
12 - attack.t1016
13logsource:
14 product: macos
15 category: process_creation
16detection:
17 selection1:
18 Image|endswith:
19 - '/netstat'
20 - '/ifconfig'
21 - '/socketfilterfw'
22 - '/networksetup'
23 - '/arp'
24 selection2:
25 Image: '/usr/bin/defaults'
26 CommandLine|contains|all:
27 - 'read'
28 - '/Library/Preferences/com.apple.alf'
29 condition: 1 of selection*
30falsepositives:
31 - Legitimate administration activities
32level: informational
References
Related rules
- System Network Connections Discovery - MacOs
- Network Sniffing - Linux
- Advanced IP Scanner - File Event
- Local Groups Discovery - Linux
- Local Groups Discovery - MacOs