Data Source: Jamf Protect | Detection.FYI

Suspicious pbpaste High Volume Activity

Sep 12, 2024 · Domain: Endpoint OS: macOS Use Case: Threat Detection Tactic: Credential Access Data Source: Jamf Protect Data Source: Elastic Defend ·
Share on:

Identifies a high volume of pbpaste executions, which may indicate a bash loop continuously collecting clipboard contents, potentially allowing an attacker to harvest user credentials or other sensitive information.

Read More
User Added to the Admin Group

Sep 12, 2024 · Domain: Endpoint OS: macOS Use Case: Threat Detection Tactic: Privilege Escalation Data Source: Jamf Protect ·
Share on:

Identifies users being added to the admin group. This could be an indication of privilege escalation activity.

Read More