attack.t1204.001 | Detection.FYI

Suspicious Execution via macOS Script Editor

Nov 2, 2023 · attack.t1566 attack.t1566.002 attack.initial_access attack.t1059 attack.t1059.002 attack.t1204 attack.t1204.001 attack.execution attack.persistence attack.t1553 attack.defense_evasion ·
Share on:

Detects when the macOS Script Editor utility spawns an unusual child process.

Read More
Symlink Etc Passwd

Feb 1, 2023 · attack.t1204.001 attack.execution ·
Share on:

Detects suspicious command lines that look as if they would create symbolic links to /etc/passwd

Read More