Query: detection rule: Detects the creation of a startup item plist file, that automatically get executed at boot initialization to establish p
Matching passage: Sigma rule: Detects the creation of a startup item plist file, that automatically get executed at boot initialization to establish p. Logsource: macos / file_event. Rule: title: Startup Item File Created - MacOS id: dfe8b941-4e54-4242-b674-6b613d521962 status: test description: 'Detects the creation of a startup item plist file, that automatically get executed at boot initialization to establish persistence. Adversaries may use startup items automatically executed at boot initialization to establish persistence. Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1037.005/T1037.005.md - https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html author: Alejandro Ortuno, oscd.community date: 2020-10-14 modified: 2024-08-11 tags: - attack.persistence - attack.privilege-escalation - attack.t1037.005 logsource: category: file_event product: macos detection: selection: TargetFilename|startswith: - /Library/StartupItems/ - /System/Library/StartupItems TargetFilename|endswith: .plist condition: selection falsepositives: - Legitimate administration activities level: low
Near-miss passage: Sigma rule: Detects changes to registry keys related to "Trusted Location" of Microsoft Office where the path is set to something un. Logsource: windows / registry_set. Rule: title: Uncommon Microsoft Office Trusted Location Added id: f742bde7-9528-42e5-bd82-84f51a8387d2 related: - id: a0bed973-45fa-4625-adb5-6ecdf9be70ac type: derived status: test description: Detects changes to registry keys related to "Trusted Location" of Microsoft Office where the path is set to something uncommon. Attackers might add additional trusted locations to avoid macro security restrictions. references: - Internal Research - https://admx.help/?Category=Office2016&Policy=excel16.Office.Microsoft.Policies.Windows::L_TrustedLoc01 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-21 modified: 2023-09-29 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: Security\Trusted Locations\Location TargetObject|endswith: \Path filter_exclude_known_paths: Details|contains: - '%APPDATA%\Microsoft\Templates' - '%%APPDATA%%\Microsoft\Templates' - '%APPDATA%\Microsoft\Word\Startup' - '%%APPDATA%%\Microsoft\Word\Startup' - :\Program Files (x86)\Microsoft Office\root\Templates\ - :\Program Files\Microsoft Office (x86)\Templates - :\Program Files\Microsoft Office\root\Templates\ - :\Program Files\Microsoft Office\Templates\ filter_main_office_click_to_run: Image|contains: :\Program Files\Common Files\Microsoft Shared\ClickToRun\ Image|endswith: \OfficeClickToRun.exe filter_main_office_apps: Image|contains: - :\Program Files\Microsoft Office\ - :\Program Files (x86)\Microsoft Office\ condition: selection and not 1 of filter_main_* and not 1 of filter_exclude_* falsepositives: - Other unknown legitimate or custom paths need to be filtered to avoid false positives level: high