System Network Discovery - macOS

Detects enumeration of local network configuration

Sigma rule (View on GitHub)

 1title: System Network Discovery - macOS
 2id: 58800443-f9fc-4d55-ae0c-98a3966dfb97
 3status: test
 4description: Detects enumeration of local network configuration
 5references:
 6    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1016/T1016.md
 7author: remotephone, oscd.community
 8date: 2020/10/06
 9modified: 2022/12/28
10tags:
11    - attack.discovery
12    - attack.t1016
13logsource:
14    product: macos
15    category: process_creation
16detection:
17    selection1:
18        Image|endswith:
19            - '/netstat'
20            - '/ifconfig'
21            - '/socketfilterfw'
22            - '/networksetup'
23            - '/arp'
24    selection2:
25        Image: '/usr/bin/defaults'
26        CommandLine|contains|all:
27            - 'read'
28            - '/Library/Preferences/com.apple.alf'
29    condition: 1 of selection*
30falsepositives:
31    - Legitimate administration activities
32level: informational

References

Related rules

to-top