deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Root Account Enable Via Dsenableroot
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Sohan G (D4rkCiph3r)
Date: 2023-08-22
ATT&CK techniques: T1078, T1078.001, T1078.003
Log source: macos/process_creation

Description:
Detects attempts to enable the root account via "dsenableroot"

Detection logic:
{
  "selection": {
    "Image|endswith": "/dsenableroot"
  },
  "filter_main_disable": {
    "CommandLine|contains": " -d "
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/b27a3cb25025161d49ac861cb216db68c46a3537/atomics/T1078.003/T1078.003.md
  - https://github.com/elastic/detection-rules/blob/4312d8c9583be524578a14fe6295c3370b9a9307/rules/macos/persistence_enable_root_account.toml
  - https://ss64.com/osx/dsenableroot.html
Sigma Detection Rule: Time Machine Backup Deletion Attempt Via Tmutil - MacOS
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Pratinav Chandra
Date: 2024-05-29
ATT&CK techniques: T1490
Log source: macos/process_creation

Description:
Detects deletion attempts of MacOS Time Machine backups via the native backup utility "tmutil".
An adversary may perform this action before launching a ransonware attack to prevent the victim from restoring their files.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "/tmutil"
    },
    {
      "CommandLine|contains": "tmutil"
    }
  ],
  "selection_cmd": {
    "CommandLine|contains": "delete"
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-12---disable-time-machine
  - https://www.loobins.io/binaries/tmutil/
Sigma Detection Rule: Decode Base64 Encoded Text -MacOs
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Daniil Yugoslavskiy, oscd.community
Date: 2020-10-19
ATT&CK techniques: T1027
Log source: macos/process_creation

Description:
Detects usage of base64 utility to decode arbitrary base64-encoded text

Detection logic:
{
  "selection": {
    "Image": "/usr/bin/base64",
    "CommandLine|contains": "-d"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027/T1027.md
Sigma Detection Rule: User Added To Admin Group Via Sysadminctl
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Sohan G (D4rkCiph3r)
Date: 2023-03-19
ATT&CK techniques: T1078.003
Log source: macos/process_creation

Description:
Detects attempts to create and add an account to the admin group via "sysadminctl"

Detection logic:
{
  "selection": {
    "Image|endswith": "/sysadminctl",
    "CommandLine|contains|all": [
      " -addUser ",
      " -admin "
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1078.003/T1078.003.md#atomic-test-3---create-local-account-with-admin-privileges-using-sysadminctl-utility---macos
  - https://ss64.com/osx/sysadminctl.html
Sigma Detection Rule: Potential WizardUpdate Malware Infection
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Tim Rauch (rule), Elastic (idea)
Date: 2022-10-17
Log source: macos/process_creation

Description:
Detects the execution traces of the WizardUpdate malware. WizardUpdate is a macOS trojan that attempts to infiltrate macOS machines to steal data and it is associated with other types of malicious payloads, increasing the chances of multiple infections on a device.

Detection logic:
{
  "selection_1": {
    "Image|endswith": "/sh",
    "CommandLine|contains|all": [
      "=$(curl ",
      "eval"
    ]
  },
  "selection_2": {
    "Image|endswith": "/curl",
    "CommandLine|contains": "_intermediate_agent_"
  },
  "condition": "1 of selection_*"
}

References:
  - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-c68a1fcbf7a3f80c87225d7fdc031f691e9f3b6a14a36754be00762bfe6eae97
  - https://malpedia.caad.fkie.fraunhofer.de/details/osx.xcsset
  - https://www.microsoft.com/security/blog/2022/02/02/the-evolution-of-a-mac-trojan-updateagents-progression/
Sigma Detection Rule: Local Groups Discovery - MacOs
Repository: SigmaHQ/sigma
Severity: informational
Status: test
Author: Ömer Günal, Alejandro Ortuno, oscd.community
Date: 2020-10-11
ATT&CK techniques: T1069.001
Log source: macos/process_creation

Description:
Detects enumeration of local system groups

Detection logic:
{
  "selection_1": {
    "Image|endswith": "/dscacheutil",
    "CommandLine|contains|all": [
      "-q",
      "group"
    ]
  },
  "selection_2": {
    "Image|endswith": "/cat",
    "CommandLine|contains": "/etc/group"
  },
  "selection_3": {
    "Image|endswith": "/dscl",
    "CommandLine|contains|all": [
      "-list",
      "/groups"
    ]
  },
  "condition": "1 of selection*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1069.001/T1069.001.md
Sigma Detection Rule: Credentials In Files
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Igor Fits, Mikhail Larin, oscd.community
Date: 2020-10-19
ATT&CK techniques: T1552.001
Log source: macos/process_creation

Description:
Detecting attempts to extract passwords with grep and laZagne

Detection logic:
{
  "selection1": {
    "Image|endswith": "/grep",
    "CommandLine|contains": "password"
  },
  "selection2": {
    "CommandLine|contains": "laZagne"
  },
  "condition": "1 of selection*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.001/T1552.001.md
Sigma Detection Rule: System Network Discovery - macOS
Repository: SigmaHQ/sigma
Severity: informational
Status: test
Author: remotephone, oscd.community
Date: 2020-10-06
ATT&CK techniques: T1016
Log source: macos/process_creation

Description:
Detects enumeration of local network configuration

Detection logic:
{
  "selection_1": {
    "Image|endswith": [
      "/arp",
      "/ifconfig",
      "/netstat",
      "/networksetup",
      "/socketfilterfw"
    ]
  },
  "selection_2": {
    "Image": "/usr/bin/defaults",
    "CommandLine|contains|all": [
      "/Library/Preferences/com.apple.alf",
      "read"
    ]
  },
  "filter_main_wifivelocityd": {
    "ParentImage|endswith": "/wifivelocityd"
  },
  "condition": "1 of selection_* and not 1 of filter_main_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1016/T1016.md
Sigma Detection Rule: Remote Access Tool - Team Viewer Session Started On MacOS Host
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Josh Nickels, Qi Nan
Date: 2024-03-11
ATT&CK techniques: T1133
Log source: macos/process_creation

Description:
Detects the command line executed when TeamViewer starts a session started by a remote host.
Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.


Detection logic:
{
  "selection": {
    "ParentImage|endswith": "/TeamViewer_Service",
    "Image|endswith": "/TeamViewer_Desktop",
    "CommandLine|endswith": "/TeamViewer_Desktop --IPCport 5939 --Module 1"
  },
  "condition": "selection"
}

References:
  - Internal Research
Sigma Detection Rule: Suspicious Microsoft Office Child Process - MacOS
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Sohan G (D4rkCiph3r)
Date: 2023-01-31
ATT&CK techniques: T1059.002, T1137.002, T1204.002
Log source: macos/process_creation

Description:
Detects suspicious child processes spawning from microsoft office suite applications such as word or excel. This could indicates malicious macro execution

Detection logic:
{
  "selection": {
    "ParentImage|contains": [
      "Microsoft Word",
      "Microsoft Excel",
      "Microsoft PowerPoint",
      "Microsoft OneNote"
    ],
    "Image|endswith": [
      "/bash",
      "/curl",
      "/dash",
      "/fish",
      "/osacompile",
      "/osascript",
      "/sh",
      "/zsh",
      "/python",
      "/python3",
      "/wget"
    ]
  },
  "condition": "selection"
}

References:
  - https://redcanary.com/blog/applescript/
  - https://objective-see.org/blog/blog_0x4B.html
Sigma Detection Rule: Launch Agent/Daemon Execution Via Launchctl
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Pratinav Chandra
Date: 2024-05-13
ATT&CK techniques: T1569.001, T1543.001, T1543.004
Log source: macos/process_creation

Description:
Detects the execution of programs as Launch Agents or Launch Daemons using launchctl on macOS.

Detection logic:
{
  "selection": {
    "Image|endswith": "/launchctl",
    "CommandLine|contains": [
      "submit",
      "load",
      "start"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1569.001/T1569.001.md
  - https://www.sentinelone.com/labs/20-common-tools-techniques-used-by-macos-threat-actors-malware/
  - https://www.welivesecurity.com/2020/07/16/mac-cryptocurrency-trading-application-rebranded-bundled-malware/
  - https://www.trendmicro.com/en_us/research/18/d/new-macos-backdoor-linked-to-oceanlotus-found.html
  - https://www.loobins.io/binaries/launchctl/
Sigma Detection Rule: Indicator Removal on Host - Clear Mac System Logs
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: remotephone, oscd.community
Date: 2020-10-11
ATT&CK techniques: T1685.006
Log source: macos/process_creation

Description:
Detects deletion of local audit logs

Detection logic:
{
  "selection1": {
    "Image|endswith": [
      "/rm",
      "/unlink",
      "/shred"
    ]
  },
  "selection_cli_1": {
    "CommandLine|contains": "/var/log"
  },
  "selection_cli_2": {
    "CommandLine|contains|all": [
      "/Users/",
      "/Library/Logs/"
    ]
  },
  "condition": "selection1 and 1 of selection_cli*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.002/T1070.002.md
Sigma Detection Rule: Remote Access Tool - Renamed MeshAgent Execution - MacOS
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Norbert Jaśniewicz (AlphaSOC)
Date: 2025-05-19
ATT&CK techniques: T1219.002, T1036.003
Log source: macos/process_creation

Description:
Detects the execution of a renamed instance of the Remote Monitoring and Management (RMM) tool, MeshAgent.
RMM tools such as MeshAgent are commonly utilized by IT administrators for legitimate remote support and system management.
However, malicious actors may exploit these tools by renaming them to bypass detection mechanisms, enabling unauthorized access and control over compromised systems.


Detection logic:
{
  "selection_meshagent": [
    {
      "CommandLine|contains": "--meshServiceName"
    },
    {
      "OriginalFileName|contains": "meshagent"
    }
  ],
  "filter_main_legitimate": {
    "Image|endswith": [
      "/meshagent",
      "/meshagent_osx64"
    ]
  },
  "condition": "selection_meshagent and not 1 of filter_main_*"
}

References:
  - https://www.huntress.com/blog/know-thy-enemy-a-novel-november-case-on-persistent-remote-access
  - https://thecyberexpress.com/ukraine-hit-by-meshagent-malware-campaign/
  - https://wazuh.com/blog/how-to-detect-meshagent-with-wazuh/
  - https://www.security.com/threat-intelligence/medusa-ransomware-attacks
Sigma Detection Rule: System Shutdown/Reboot - MacOs
Repository: SigmaHQ/sigma
Severity: informational
Status: test
Author: Igor Fits, Mikhail Larin, oscd.community
Date: 2020-10-19
ATT&CK techniques: T1529
Log source: macos/process_creation

Description:
Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "/shutdown",
      "/reboot",
      "/halt"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1529/T1529.md
Sigma Detection Rule: Suspicious Installer Package Child Process
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Sohan G (D4rkCiph3r)
Date: 2023-02-18
ATT&CK techniques: T1059, T1059.007, T1071, T1071.001
Log source: macos/process_creation

Description:
Detects the execution of suspicious child processes from macOS installer package parent process. This includes osascript, JXA, curl and wget amongst other interpreters

Detection logic:
{
  "selection_installer": {
    "ParentImage|endswith": [
      "/package_script_service",
      "/installer"
    ],
    "Image|endswith": [
      "/sh",
      "/bash",
      "/dash",
      "/python",
      "/ruby",
      "/perl",
      "/php",
      "/javascript",
      "/osascript",
      "/tclsh",
      "/curl",
      "/wget"
    ],
    "CommandLine|contains": [
      "preinstall",
      "postinstall"
    ]
  },
  "condition": "selection_installer"
}

References:
  - https://redcanary.com/blog/clipping-silver-sparrows-wings/
  - https://github.com/elastic/detection-rules/blob/4312d8c9583be524578a14fe6295c3370b9a9307/rules/macos/execution_installer_package_spawned_network_event.toml
Sigma Detection Rule: Clipboard Data Collection Via OSAScript
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Sohan G (D4rkCiph3r)
Date: 2023-01-31
ATT&CK techniques: T1115, T1059.002
Log source: macos/process_creation

Description:
Detects possible collection of data from the clipboard via execution of the osascript binary

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "osascript",
      " -e ",
      "clipboard"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.sentinelone.com/blog/how-offensive-actors-use-applescript-for-attacking-macos/
Sigma Detection Rule: New File Exclusion Added To Time Machine Via Tmutil - MacOS
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Pratinav Chandra
Date: 2024-05-29
ATT&CK techniques: T1490
Log source: macos/process_creation

Description:
Detects the addition of a new file or path exclusion to MacOS Time Machine via the "tmutil" utility.
An adversary could exclude a path from Time Machine backups to prevent certain files from being backed up.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "/tmutil"
    },
    {
      "CommandLine|contains": "tmutil"
    }
  ],
  "selection_cmd": {
    "CommandLine|contains": "addexclusion"
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-12---disable-time-machine
  - https://www.loobins.io/binaries/tmutil/
Sigma Detection Rule: User Added To Admin Group Via DseditGroup
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Sohan G (D4rkCiph3r)
Date: 2023-08-22
ATT&CK techniques: T1078.003
Log source: macos/process_creation

Description:
Detects attempts to create and/or add an account to the admin group, thus granting admin privileges.

Detection logic:
{
  "selection": {
    "Image|endswith": "/dseditgroup",
    "CommandLine|contains|all": [
      " -o edit ",
      " -a ",
      " -t user",
      "admin"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1078.003/T1078.003.md#atomic-test-5---add-a-newexisting-user-to-the-admin-group-using-dseditgroup-utility---macos
  - https://ss64.com/osx/dseditgroup.html
Sigma Detection Rule: Disable Security Tools
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Daniil Yugoslavskiy, oscd.community
Date: 2020-10-19
ATT&CK techniques: T1685
Log source: macos/process_creation

Description:
Detects disabling security tools

Detection logic:
{
  "launchctl_unload": {
    "Image": "/bin/launchctl",
    "CommandLine|contains": "unload"
  },
  "security_plists": {
    "CommandLine|contains": [
      "com.objective-see.lulu.plist",
      "com.objective-see.blockblock.plist",
      "com.google.santad.plist",
      "com.carbonblack.defense.daemon.plist",
      "com.carbonblack.daemon.plist",
      "at.obdev.littlesnitchd.plist",
      "com.tenablesecurity.nessusagent.plist",
      "com.opendns.osx.RoamingClientConfigUpdater.plist",
      "com.crowdstrike.falcond.plist",
      "com.crowdstrike.userdaemon.plist",
      "osquery",
      "filebeat",
      "auditbeat",
      "packetbeat",
      "td-agent"
    ]
  },
  "disable_gatekeeper": {
    "Image": "/usr/sbin/spctl",
    "CommandLine|contains": "disable"
  },
  "condition": "(launchctl_unload and security_plists) or disable_gatekeeper"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
Sigma Detection Rule: Split A File Into Pieces
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Igor Fits, Mikhail Larin, oscd.community
Date: 2020-10-15
ATT&CK techniques: T1030
Log source: macos/process_creation

Description:
Detection use of the command "split" to split files into parts and possible transfer.

Detection logic:
{
  "selection": {
    "Image|endswith": "/split"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1030/T1030.md
Sigma Detection Rule: System Integrity Protection (SIP) Disabled
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
Date: 2024-01-02
ATT&CK techniques: T1518.001
Log source: macos/process_creation

Description:
Detects the use of csrutil to disable the Configure System Integrity Protection (SIP). This technique is used in post-exploit scenarios.


Detection logic:
{
  "selection": {
    "Image|endswith": "/csrutil",
    "CommandLine|contains": "disable"
  },
  "condition": "selection"
}

References:
  - https://ss64.com/osx/csrutil.html
  - https://objective-see.org/blog/blog_0x6D.html
  - https://www.welivesecurity.com/2017/10/20/osx-proton-supply-chain-attack-elmedia/
  - https://www.virustotal.com/gui/file/05a2adb266ec6c0ba9ed176d87d8530e71e845348c13caf9f60049760c312cd3/behavior
Sigma Detection Rule: JAMF MDM Potential Suspicious Child Process
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-08-22
Log source: macos/process_creation

Description:
Detects potential suspicious child processes of "jamf". Could be a sign of potential abuse of Jamf as a C2 server as seen by Typhon MythicAgent.

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "/jamf",
    "Image|endswith": [
      "/bash",
      "/sh"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/MythicAgents/typhon/
  - https://www.zoocoup.org/casper/jamf_cheatsheet.pdf
  - https://docs.jamf.com/10.30.0/jamf-pro/administrator-guide/Components_Installed_on_Managed_Computers.html
Sigma Detection Rule: System Information Discovery Using System_Profiler
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Stephen Lincoln `@slincoln_aiq` (AttackIQ)
Date: 2024-01-02
ATT&CK techniques: T1082, T1497.001
Log source: macos/process_creation

Description:
Detects the execution of "system_profiler" with specific "Data Types" that have been seen being used by threat actors and malware. It provides system hardware and software configuration information.
This process is primarily used for system information discovery. However, "system_profiler" can also be used to determine if virtualization software is being run for defense evasion purposes.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "/system_profiler"
    },
    {
      "CommandLine|contains": "system_profiler"
    }
  ],
  "selection_cmd": {
    "CommandLine|contains": [
      "SPApplicationsDataType",
      "SPHardwareDataType",
      "SPNetworkDataType",
      "SPUSBDataType"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.trendmicro.com/en_za/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html
  - https://www.sentinelone.com/wp-content/uploads/pdf-gen/[PII_REDACTED]/20-common-tools-techniques-used-by-macos-threat-actors-malware.pdf
  - https://ss64.com/mac/system_profiler.html
  - https://objective-see.org/blog/blog_0x62.html
  - https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/
Sigma Detection Rule: Hidden User Creation
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Daniil Yugoslavskiy, oscd.community
Date: 2020-10-10
ATT&CK techniques: T1564.002
Log source: macos/process_creation

Description:
Detects creation of a hidden user account on macOS (UserID < 500) or with IsHidden option

Detection logic:
{
  "dscl_create": {
    "Image|endswith": "/dscl",
    "CommandLine|contains": "create"
  },
  "id_below_500": {
    "CommandLine|contains": "UniqueID",
    "CommandLine|re": "([0-9]|[1-9][0-9]|[1-4][0-9]{2})"
  },
  "ishidden_option_declaration": {
    "CommandLine|contains": "IsHidden"
  },
  "ishidden_option_confirmation": {
    "CommandLine|contains": [
      "true",
      "yes",
      "1"
    ]
  },
  "condition": "dscl_create and id_below_500 or dscl_create and (ishidden_option_declaration and ishidden_option_confirmation)"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.002/T1564.002.md
Sigma Detection Rule: Gatekeeper Bypass via Xattr
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Daniil Yugoslavskiy, oscd.community
Date: 2020-10-19
ATT&CK techniques: T1553.001
Log source: macos/process_creation

Description:
Detects macOS Gatekeeper bypass via xattr utility

Detection logic:
{
  "selection": {
    "Image|endswith": "/xattr",
    "CommandLine|contains|all": [
      "-d",
      "com.apple.quarantine"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/1fed40dc7e48f16ed44dcdd9c73b9222a70cca85/atomics/T1553.001/T1553.001.md
  - https://www.loobins.io/binaries/xattr/
Sigma Detection Rule: User Added To Admin Group Via Dscl
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Sohan G (D4rkCiph3r)
Date: 2023-03-19
ATT&CK techniques: T1078.003
Log source: macos/process_creation

Description:
Detects attempts to create and add an account to the admin group via "dscl"

Detection logic:
{
  "selection": {
    "Image|endswith": "/dscl",
    "CommandLine|contains|all": [
      " -append ",
      " /Groups/admin ",
      " GroupMembership "
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1078.003/T1078.003.md#atomic-test-2---create-local-account-with-admin-privileges---macos
  - https://ss64.com/osx/dscl.html
Sigma Detection Rule: Macos Remote System Discovery
Repository: SigmaHQ/sigma
Severity: informational
Status: test
Author: Alejandro Ortuno, oscd.community
Date: 2020-10-22
ATT&CK techniques: T1018
Log source: macos/process_creation

Description:
Detects the enumeration of other remote systems.

Detection logic:
{
  "selection_1": {
    "Image|endswith": "/arp",
    "CommandLine|contains": "-a"
  },
  "selection_2": {
    "Image|endswith": "/ping",
    "CommandLine|contains": [
      " 10.",
      " 192.168.",
      " 172.16.",
      " 172.17.",
      " 172.18.",
      " 172.19.",
      " 172.20.",
      " 172.21.",
      " 172.22.",
      " 172.23.",
      " 172.24.",
      " 172.25.",
      " 172.26.",
      " 172.27.",
      " 172.28.",
      " 172.29.",
      " 172.30.",
      " 172.31.",
      " 127.",
      " 169.254."
    ]
  },
  "condition": "1 of selection*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md