Data Source: Jamf Protect Event Logs | Detection.FYI

Suspicious pbpaste High Volume Activity

Sep 19, 2026 · Domain: Endpoint OS: macOS Use Case: Threat Detection Tactic: Credential Access Data Source: Jamf Protect Data Source: Elastic Defend Resources: Investigation Guide Noise: High Performance: Normal Profile: Aggressive Rule Type: Event Correlation (EQL) Platform: macOS Data Source: Jamf Protect Event Logs ·
Share on:

Identifies a high volume of pbpaste executions, which may indicate a bash loop continuously collecting clipboard contents, potentially allowing an attacker to harvest user credentials or other sensitive information.

Read More
User Added to the Admin Group

Sep 19, 2026 · Domain: Endpoint OS: macOS Use Case: Threat Detection Tactic: Privilege Escalation Data Source: Jamf Protect Resources: Investigation Guide Noise: Low Performance: Fast Rule Type: Event Correlation (EQL) Platform: macOS Data Source: Jamf Protect Event Logs ·
Share on:

Identifies users being added to the admin group. This could be an indication of privilege escalation activity.

Read More