Data Source: Jamf Protect | Detection.FYI

Suspicious pbpaste High Volume Activity

Jan 22, 2025 · Domain: Endpoint OS: macOS Use Case: Threat Detection Tactic: Credential Access Data Source: Jamf Protect Data Source: Elastic Defend Resources: Investigation Guide ·
Share on:

Identifies a high volume of pbpaste executions, which may indicate a bash loop continuously collecting clipboard contents, potentially allowing an attacker to harvest user credentials or other sensitive information.

Read More
User Added to the Admin Group

Jan 22, 2025 · Domain: Endpoint OS: macOS Use Case: Threat Detection Tactic: Privilege Escalation Data Source: Jamf Protect Resources: Investigation Guide ·
Share on:

Identifies users being added to the admin group. This could be an indication of privilege escalation activity.

Read More