Query: Sigma rule for Detects macOS Gatekeeper bypass via xattr utility
Matching passage: Sigma rule: Detects macOS Gatekeeper bypass via xattr utility. Logsource: macos / process_creation. Rule: title: Gatekeeper Bypass via Xattr id: f5141b6d-9f42-41c6-a7bf-2a780678b29b status: test description: Detects macOS Gatekeeper bypass via xattr utility references: - https://github.com/redcanaryco/atomic-red-team/blob/1fed40dc7e48f16ed44dcdd9c73b9222a70cca85/atomics/T1553.001/T1553.001.md - https://www.loobins.io/binaries/xattr/ author: Daniil Yugoslavskiy, oscd.community date: 2020-10-19 modified: 2024-04-18 tags: - attack.defense-impairment - attack.t1553.001 logsource: category: process_creation product: macos detection: selection: Image|endswith: /xattr CommandLine|contains|all: - -d - com.apple.quarantine condition: selection falsepositives: - Legitimate activities level: low
Near-miss passage: Sigma rule: Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery.. Logsource: windows / process_creation. Rule: title: Csc.EXE Execution Form Potentially Suspicious Parent id: b730a276-6b63-41b8-bcf8-55930c8fc6ee status: test description: Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery. references: - https://www.uptycs.com/blog/warzonerat-can-now-evade-with-process-hollowing - https://reaqta.com/2017/11/short-journey-darkvnc/ - https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) date: 2019-02-11 modified: 2026-03-23 tags: - attack.execution - attack.stealth - attack.t1059.005 - attack.t1059.007 - attack.t1218.005 - attack.t1027.004 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \csc.exe - OriginalFileName: csc.exe selection_parent_generic: ParentImage|endswith: - \cscript.exe - \excel.exe - \mshta.exe - \onenote.exe - \outlook.exe - \powerpnt.exe - \winword.exe - \wscript.exe selection_parent_powershell: ParentImage|endswith: - \powershell.exe - \pwsh.exe ParentCommandLine|contains: - '-Encoded ' - FromBase64String selection_parent_susp_location: - ParentCommandLine|re: (?:[Pp]rogram[Dd]ata|%(?:[Ll]ocal)?[Aa]pp[Dd]ata%|\\[Aa]pp[Dd]ata\\(?:[Ll]ocal(?:[Ll]ow)?|[Rr]oaming))\\[^\\]{1,256}$ - ParentCommandLine|contains: - :\PerfLogs\ - :\Users\Public\ - :\Windows\Temp\ - \Temporary Internet - ParentCommandLine|contains|all: - :\Users\ - \Favorites\ - ParentCommandLine|contains|all: - :\Users\ - \Favourites\ - ParentCommandLine|contains|all: - :\Users\ - \Contacts\ - ParentCommandLine|contains|all: - :\Users\ - \Pictures\ filter_main_programfiles: ParentImage|startswith: - C:\Program Files (x86)\ - C:\Program Files\ filter_main_sdiagnhost: ParentImage: C:\Windows\System32\sdiagnhost.exe filter_main_w3p: ParentImage: C:\Windows\System32\inetsrv\w3wp.exe filter_optional_chocolatey: ParentImage: C:\ProgramData\chocolatey\choco.exe filter_optional_defender: ParentCommandLine|contains: \ProgramData\Microsoft\Windows Defender Advanced Threat Protection filter_optional_ansible: ParentCommandLine|contains: - JwB7ACIAZgBhAGkAbABlAGQAIgA6AHQAcgB1AGUALAAiAG0AcwBnACIAOgAiAEEAbgBzAGkAYgBsAGUAIAByAGUAcQB1AGkAcgBlAHMAIABQAG8AdwBlAHIAUwBoAGUAbABsACAAdgAzAC4AMAAgAG8AcgAgAG4AZQB3AGUAcgAiAH0AJw - cAewAiAGYAYQBpAGwAZQBkACIAOgB0AHIAdQBlACwAIgBtAHMAZwAiADoAIgBBAG4AcwBpAGIAbABlACAAcgBlAHEAdQBpAHIAZQBzAC