deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Binary Padding - MacOS
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Igor Fits, Mikhail Larin, oscd.community
Date: 2020-10-19
ATT&CK techniques: T1027.001
Log source: macos/process_creation

Description:
Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This rule detect using dd and truncate to add a junk data to file.

Detection logic:
{
  "selection_truncate": {
    "Image|endswith": "/truncate",
    "CommandLine|contains": "-s +"
  },
  "selection_dd": {
    "Image|endswith": "/dd",
    "CommandLine|contains": [
      "if=/dev/zero",
      "if=/dev/random",
      "if=/dev/urandom"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027.001/T1027.001.md
  - https://linux.die.net/man/1/truncate
  - https://linux.die.net/man/1/dd
Sigma Detection Rule: JXA In-memory Execution Via OSAScript
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Sohan G (D4rkCiph3r)
Date: 2023-01-31
ATT&CK techniques: T1059.002, T1059.007
Log source: macos/process_creation

Description:
Detects possible malicious execution of JXA in-memory via OSAScript

Detection logic:
{
  "selection_main": {
    "CommandLine|contains|all": [
      "osascript",
      " -e ",
      "eval",
      "NSData.dataWithContentsOfURL"
    ]
  },
  "selection_js": [
    {
      "CommandLine|contains|all": [
        " -l ",
        "JavaScript"
      ]
    },
    {
      "CommandLine|contains": ".js"
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://redcanary.com/blog/applescript/
Sigma Detection Rule: Potential Discovery Activity Using Find - MacOS
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-12-28
ATT&CK techniques: T1083
Log source: macos/process_creation

Description:
Detects usage of "find" binary in a suspicious manner to perform discovery

Detection logic:
{
  "selection": {
    "Image|endswith": "/find",
    "CommandLine|contains": [
      "-perm -4000",
      "-perm -2000",
      "-perm 0777",
      "-perm -222",
      "-perm -o w",
      "-perm -o x",
      "-perm -u=s",
      "-perm -g=s"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/SaiSathvik1/Linux-Privilege-Escalation-Notes
Sigma Detection Rule: System Network Connections Discovery - MacOs
Repository: SigmaHQ/sigma
Severity: informational
Status: test
Author: Daniil Yugoslavskiy, oscd.community
Date: 2020-10-19
ATT&CK techniques: T1049
Log source: macos/process_creation

Description:
Detects usage of system utilities to discover system network connections

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "/who",
      "/w",
      "/last",
      "/lsof",
      "/netstat"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md
Sigma Detection Rule: JAMF MDM Execution
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Jay Pandit
Date: 2023-08-22
Log source: macos/process_creation

Description:
Detects execution of the "jamf" binary to create user accounts and run commands. For example, the binary can be abused by attackers on the system in order to bypass security controls or remove application control polices.


Detection logic:
{
  "selection": {
    "Image|endswith": "/jamf",
    "CommandLine|contains": [
      "createAccount",
      "manage",
      "removeFramework",
      "removeMdmProfile",
      "resetPassword",
      "setComputerName"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/MythicAgents/typhon/
  - https://www.zoocoup.org/casper/jamf_cheatsheet.pdf
  - https://docs.jamf.com/10.30.0/jamf-pro/administrator-guide/Components_Installed_on_Managed_Computers.html
Sigma Detection Rule: Potential Persistence Via PlistBuddy
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Sohan G (D4rkCiph3r)
Date: 2023-02-18
ATT&CK techniques: T1543.001, T1543.004
Log source: macos/process_creation

Description:
Detects potential persistence activity using LaunchAgents or LaunchDaemons via the PlistBuddy utility

Detection logic:
{
  "selection": {
    "Image|endswith": "/PlistBuddy",
    "CommandLine|contains|all": [
      "RunAtLoad",
      "true"
    ],
    "CommandLine|contains": [
      "LaunchAgents",
      "LaunchDaemons"
    ]
  },
  "condition": "selection"
}

References:
  - https://redcanary.com/blog/clipping-silver-sparrows-wings/
  - https://www.manpagez.com/man/8/PlistBuddy/
Sigma Detection Rule: Potential In-Memory Download And Compile Of Payloads
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Sohan G (D4rkCiph3r), Red Canary (idea)
Date: 2023-08-22
ATT&CK techniques: T1059.007, T1105
Log source: macos/process_creation

Description:
Detects potential in-memory downloading and compiling of applets using curl and osacompile as seen used by XCSSET malware

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "osacompile",
      "curl"
    ]
  },
  "condition": "selection"
}

References:
  - https://redcanary.com/blog/mac-application-bundles/
Sigma Detection Rule: Potential XCSSET Malware Infection
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Tim Rauch (rule), Elastic (idea)
Date: 2022-10-17
Log source: macos/process_creation

Description:
Identifies the execution traces of the XCSSET malware. XCSSET is a macOS trojan that primarily spreads via Xcode projects and maliciously modifies applications. Infected users are also vulnerable to having their credentials, accounts, and other vital data stolen.

Detection logic:
{
  "selection_1_curl": {
    "ParentImage|endswith": "/bash",
    "Image|endswith": "/curl",
    "CommandLine|contains": [
      "/sys/log.php",
      "/sys/prepod.php",
      "/sys/bin/Pods"
    ]
  },
  "selection_1_https": {
    "CommandLine|contains": "https://"
  },
  "selection_other_1": {
    "ParentImage|endswith": "/bash",
    "Image|endswith": "/osacompile",
    "CommandLine|contains|all": [
      "/Users/",
      "/Library/Group Containers/"
    ]
  },
  "selection_other_2": {
    "ParentImage|endswith": "/bash",
    "Image|endswith": "/plutil",
    "CommandLine|contains|all": [
      "LSUIElement",
      "/Users/",
      "/Library/Group Containers/"
    ]
  },
  "selection_other_3": {
    "Image|endswith": "/zip",
    "CommandLine|contains|all": [
      "-r",
      "/Users/",
      "/Library/Group Containers/"
    ]
  },
  "condition": "all of selection_1_* or 1 of selection_other_*"
}

References:
  - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-f5deb07688e1a8dec9530bc3071967b2da5c16b482e671812b864c37beb28f08
  - https://malpedia.caad.fkie.fraunhofer.de/details/osx.xcsset
Sigma Detection Rule: System Integrity Protection (SIP) Enumeration
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
Date: 2024-01-02
ATT&CK techniques: T1518.001
Log source: macos/process_creation

Description:
Detects the use of csrutil to view the Configure System Integrity Protection (SIP) status. This technique is used in post-exploit scenarios.


Detection logic:
{
  "selection": {
    "Image|endswith": "/csrutil",
    "CommandLine|contains": "status"
  },
  "condition": "selection"
}

References:
  - https://ss64.com/osx/csrutil.html
  - https://objective-see.org/blog/blog_0x6D.html
  - https://www.welivesecurity.com/2017/10/20/osx-proton-supply-chain-attack-elmedia/
  - https://www.virustotal.com/gui/file/05a2adb266ec6c0ba9ed176d87d8530e71e845348c13caf9f60049760c312cd3/behavior
Sigma Detection Rule: Remote Access Tool - Potential MeshAgent Execution - MacOS
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Norbert Jaśniewicz (AlphaSOC)
Date: 2025-05-19
ATT&CK techniques: T1219.002
Log source: macos/process_creation

Description:
Detects potential execution of MeshAgent which is a tool used for remote access.
Historical data shows that threat actors rename MeshAgent binary to evade detection.
Matching command lines with the '--meshServiceName' argument can indicate that the MeshAgent is being used for remote access.


Detection logic:
{
  "selection": {
    "CommandLine|contains": "--meshServiceName"
  },
  "condition": "selection"
}

References:
  - https://www.huntress.com/blog/know-thy-enemy-a-novel-november-case-on-persistent-remote-access
  - https://thecyberexpress.com/ukraine-hit-by-meshagent-malware-campaign/
  - https://wazuh.com/blog/how-to-detect-meshagent-with-wazuh/
  - https://www.security.com/threat-intelligence/medusa-ransomware-attacks
Sigma Detection Rule: Time Machine Backup Disabled Via Tmutil - MacOS
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Pratinav Chandra
Date: 2024-05-29
ATT&CK techniques: T1490
Log source: macos/process_creation

Description:
Detects disabling of Time Machine (Apple's automated backup utility software) via the native macOS backup utility "tmutil".
An attacker can use this to prevent backups from occurring.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "/tmutil"
    },
    {
      "CommandLine|contains": "tmutil"
    }
  ],
  "selection_cmd": {
    "CommandLine|contains": "disable"
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-12---disable-time-machine
  - https://www.loobins.io/binaries/tmutil/
Sigma Detection Rule: Suspicious Execution via macOS Script Editor
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Tim Rauch (rule), Elastic (idea)
Date: 2022-10-21
ATT&CK techniques: T1566, T1566.002, T1059, T1059.002, T1204, T1204.001, T1553
Log source: macos/process_creation

Description:
Detects when the macOS Script Editor utility spawns an unusual child process.

Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": "/Script Editor"
  },
  "selection_img": [
    {
      "Image|endswith": [
        "/curl",
        "/bash",
        "/sh",
        "/zsh",
        "/dash",
        "/fish",
        "/osascript",
        "/mktemp",
        "/chmod",
        "/php",
        "/nohup",
        "/openssl",
        "/plutil",
        "/PlistBuddy",
        "/xattr",
        "/sqlite",
        "/funzip",
        "/popen"
      ]
    },
    {
      "Image|contains": [
        "python",
        "perl"
      ]
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-7f541fbc4a4a28a92970e8bf53effea5bd[PII_REDACTED]12c920affb457f5b2685
  - https://wojciechregula.blog/post/macos-red-teaming-initial-access-via-applescript-url/
Sigma Detection Rule: File Download Via Nscurl - MacOS
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Daniel Cortez
Date: 2024-06-04
ATT&CK techniques: T1105
Log source: macos/process_creation

Description:
Detects the execution of the nscurl utility in order to download files.

Detection logic:
{
  "selection": {
    "Image|endswith": "/nscurl",
    "CommandLine|contains": [
      "--download ",
      "--download-directory ",
      "--output ",
      "-dir ",
      "-dl ",
      "-ld",
      "-o "
    ]
  },
  "condition": "selection"
}

References:
  - https://www.loobins.io/binaries/nscurl/
  - https://www.agnosticdev.com/content/how-diagnose-app-transport-security-issues-using-nscurl-and-openssl
  - https://gist.github.com/nasbench/ca6ef95db04ae04ffd1e0b1ce709cadd
Sigma Detection Rule: Suspicious History File Operations
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Mikhail Larin, oscd.community
Date: 2020-10-17
ATT&CK techniques: T1552.003
Log source: macos/process_creation

Description:
Detects commandline operations on shell history files

Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      ".bash_history",
      ".zsh_history",
      ".zhistory",
      ".history",
      ".sh_history",
      "fish_history"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.003/T1552.003.md
Sigma Detection Rule: Payload Decoded and Decrypted via Built-in Utilities
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Tim Rauch (rule), Elastic (idea)
Date: 2022-10-17
ATT&CK techniques: T1059, T1204, T1140
Log source: macos/process_creation

Description:
Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.

Detection logic:
{
  "selection": {
    "Image|endswith": "/openssl",
    "CommandLine|contains|all": [
      "/Volumes/",
      "enc",
      "-base64",
      " -d "
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-5d42c3d772e04f1e8d0eb60f5233bc79def1ea73105a2d8822f44164f77ef823
Sigma Detection Rule: System Information Discovery Via Sysctl - MacOS
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Pratinav Chandra
Date: 2024-05-27
ATT&CK techniques: T1497.001, T1082
Log source: macos/process_creation

Description:
Detects the execution of "sysctl" with specific arguments that have been used by threat actors and malware. It provides system hardware information.
This process is primarily used to detect and avoid virtualization and analysis environments.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "/sysctl"
    },
    {
      "CommandLine|contains": "sysctl"
    }
  ],
  "selection_cmd": {
    "CommandLine|contains": [
      "hw.",
      "kern.",
      "machdep."
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.loobins.io/binaries/sysctl/#
  - https://evasions.checkpoint.com/techniques/macos.html
  - https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/
  - https://www.sentinelone.com/labs/20-common-tools-techniques-used-by-macos-threat-actors-malware/
  - https://objective-see.org/blog/blog_0x1E.html
Sigma Detection Rule: Guest Account Enabled Via Sysadminctl
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Sohan G (D4rkCiph3r)
Date: 2023-02-18
ATT&CK techniques: T1078, T1078.001
Log source: macos/process_creation

Description:
Detects attempts to enable the guest account using the sysadminctl utility

Detection logic:
{
  "selection": {
    "Image|endswith": "/sysadminctl",
    "CommandLine|contains|all": [
      " -guestAccount",
      " on"
    ]
  },
  "condition": "selection"
}

References:
  - https://ss64.com/osx/sysadminctl.html
Sigma Detection Rule: Disk Image Mounting Via Hdiutil - MacOS
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Omar Khaled (@beacon_exe)
Date: 2024-08-10
ATT&CK techniques: T1566.001, T1560.001
Log source: macos/process_creation

Description:
Detects the execution of the hdiutil utility in order to mount disk images.

Detection logic:
{
  "selection": {
    "Image|endswith": "/hdiutil",
    "CommandLine|contains": [
      "attach ",
      "mount "
    ]
  },
  "condition": "selection"
}

References:
  - https://www.loobins.io/binaries/hdiutil/
  - https://www.sentinelone.com/blog/from-the-front-linesunsigned-macos-orat-malware-gambles-for-the-win/
  - https://ss64.com/mac/hdiutil.html
Sigma Detection Rule: System Information Discovery Using Ioreg
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
Date: 2023-12-20
ATT&CK techniques: T1082
Log source: macos/process_creation

Description:
Detects the use of "ioreg" which will show I/O Kit registry information.
This process is used for system information discovery.
It has been observed in-the-wild by calling this process directly or using bash and grep to look for specific strings.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "/ioreg"
    },
    {
      "CommandLine|contains": "ioreg"
    }
  ],
  "selection_cmd1": {
    "CommandLine|contains": [
      "-l",
      "-c"
    ]
  },
  "selection_cmd2": {
    "CommandLine|contains": [
      "AppleAHCIDiskDriver",
      "IOPlatformExpertDevice",
      "Oracle",
      "Parallels",
      "USB Vendor Name",
      "VirtualBox",
      "VMware"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.virustotal.com/gui/file/0373d78db6c3c0f6f6dcc409821bf89e1ad8c165d6f95c5c80ecdce2219627d7/behavior
  - https://www.virustotal.com/gui/file/4ffdc72d1ff1ee8228e31691020fc275afd1baee5a985403a71ca8c7bd36e2e4/behavior
  - https://www.virustotal.com/gui/file/5907d59ec1303cfb5c0a0f4aaca3efc0830707d86c732ba6b9e842b5730b95dc/behavior
  - https://www.trendmicro.com/en_ph/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html
Sigma Detection Rule: MacOS Scripting Interpreter AppleScript
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Alejandro Ortuno, oscd.community
Date: 2020-10-21
ATT&CK techniques: T1059.002
Log source: macos/process_creation

Description:
Detects execution of AppleScript of the macOS scripting language AppleScript.

Detection logic:
{
  "selection": {
    "Image|endswith": "/osascript",
    "CommandLine|contains": [
      " -e ",
      ".scpt",
      ".js"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1059.002/T1059.002.md
  - https://redcanary.com/blog/applescript/
Sigma Detection Rule: Hidden Flag Set On File/Directory Via Chflags - MacOS
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Omar Khaled (@beacon_exe)
Date: 2024-08-21
ATT&CK techniques: T1218, T1564.004, T1552.001, T1105
Log source: macos/process_creation

Description:
Detects the execution of the "chflags" utility with the "hidden" flag, in order to hide files on MacOS.
When a file or directory has this hidden flag set, it becomes invisible to the default file listing commands and in graphical file browsers.


Detection logic:
{
  "selection": {
    "Image|endswith": "/chflags",
    "CommandLine|contains": "hidden "
  },
  "condition": "selection"
}

References:
  - https://www.sentinelone.com/labs/apt32-multi-stage-macos-trojan-innovates-on-crimeware-scripting-technique/
  - https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/
  - https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-wirelurker.pdf
  - https://ss64.com/mac/chflags.html
Sigma Detection Rule: File Time Attribute Change
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Igor Fits, Mikhail Larin, oscd.community
Date: 2020-10-19
ATT&CK techniques: T1070.006
Log source: macos/process_creation

Description:
Detect file time attribute change to hide new or changes to existing files

Detection logic:
{
  "selection": {
    "Image|endswith": "/touch",
    "CommandLine|contains": [
      "-t",
      "-acmr",
      "-d",
      "-r"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.006/T1070.006.md
Sigma Detection Rule: Space After Filename - macOS
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: remotephone
Date: 2021-11-20
ATT&CK techniques: T1036.006
Log source: macos/process_creation

Description:
Detects attempts to masquerade as legitimate files by adding a space to the end of the filename.

Detection logic:
{
  "selection1": {
    "CommandLine|endswith": " "
  },
  "selection2": {
    "Image|endswith": " "
  },
  "condition": "1 of selection*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1036.006/T1036.006.md
Sigma Detection Rule: File and Directory Discovery - MacOS
Repository: SigmaHQ/sigma
Severity: informational
Status: test
Author: Daniil Yugoslavskiy, oscd.community
Date: 2020-10-19
ATT&CK techniques: T1083
Log source: macos/process_creation

Description:
Detects usage of system utilities to discover files and directories

Detection logic:
{
  "select_file_with_asterisk": {
    "Image": "/usr/bin/file",
    "CommandLine|re": "(.){200,}"
  },
  "select_recursive_ls": {
    "Image": "/bin/ls",
    "CommandLine|contains": "-R"
  },
  "select_find_execution": {
    "Image": "/usr/bin/find"
  },
  "select_mdfind_execution": {
    "Image": "/usr/bin/mdfind"
  },
  "select_tree_execution|endswith": {
    "Image": "/tree"
  },
  "condition": "1 of select*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1083/T1083.md
Sigma Detection Rule: System Information Discovery Using sw_vers
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
Date: 2023-12-20
ATT&CK techniques: T1082
Log source: macos/process_creation

Description:
Detects the use of "sw_vers" for system information discovery

Detection logic:
{
  "selection_image": {
    "Image|endswith": "/sw_vers"
  },
  "selection_options": {
    "CommandLine|contains": [
      "-buildVersion",
      "-productName",
      "-productVersion"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.virustotal.com/gui/file/d3fa64f63563fe958b75238742d1e473800cb5f49f5cb79d38d4aa3c93709026/behavior
  - https://www.virustotal.com/gui/file/03b71eaceadea05bc0eea5cddecaa05f245126d6b16cfcd0f3ba0442ac58dab3/behavior
  - https://ss64.com/osx/sw_vers.html
Sigma Detection Rule: Screen Capture - macOS
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: remotephone, oscd.community
Date: 2020-10-13
ATT&CK techniques: T1113
Log source: macos/process_creation

Description:
Detects attempts to use screencapture to collect macOS screenshots

Detection logic:
{
  "selection": {
    "Image": "/usr/sbin/screencapture"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1113/T1113.md
  - https://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/lib/modules/python/collection/osx/screenshot.py
Sigma Detection Rule: MacOS Emond Launch Daemon
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Alejandro Ortuno, oscd.community
Date: 2020-10-23
ATT&CK techniques: T1546.014
Log source: macos/file_event

Description:
Detects additions to the Emond Launch Daemon that adversaries may use to gain persistence and elevate privileges.

Detection logic:
{
  "selection_1": {
    "TargetFilename|contains": "/etc/emond.d/rules/",
    "TargetFilename|endswith": ".plist"
  },
  "selection_2": {
    "TargetFilename|contains": "/private/var/db/emondClients/"
  },
  "condition": "1 of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.014/T1546.014.md
  - https://posts.specterops.io/leveraging-emond-on-macos-for-persistence-a040a2785124