From b8aa73764b15cb15b97e129cba43747475c7019c Mon Sep 17 00:00:00 2001 From: Raven Tait Date: Tue, 3 Mar 2026 14:52:00 -0500 Subject: [PATCH 1/8] Snap Mac Detections --- detections/endpoint/macos_account_created.yml | 51 ++++++++++++++++++ detections/endpoint/macos_data_chunking.yml | 51 ++++++++++++++++++ .../endpoint/macos_gatekeeper_bypass.yml | 53 +++++++++++++++++++ .../macos_hidden_files_and_directories.yml | 51 ++++++++++++++++++ detections/endpoint/macos_kextload_usage.yml | 52 ++++++++++++++++++ .../endpoint/macos_keychains_dumped.yml | 51 ++++++++++++++++++ detections/endpoint/macos_log_removal.yml | 51 ++++++++++++++++++ .../endpoint/macos_loginhook_persistence.yml | 51 ++++++++++++++++++ .../macos_network_share_discovery.yml | 51 ++++++++++++++++++ stories/macos_persistence_techniques.yml | 17 ++++++ stories/macos_post_exploitation.yml | 17 ++++++ stories/macos_privilege_escalation.yml | 17 ++++++ 12 files changed, 513 insertions(+) create mode 100644 detections/endpoint/macos_account_created.yml create mode 100644 detections/endpoint/macos_data_chunking.yml create mode 100644 detections/endpoint/macos_gatekeeper_bypass.yml create mode 100644 detections/endpoint/macos_hidden_files_and_directories.yml create mode 100644 detections/endpoint/macos_kextload_usage.yml create mode 100644 detections/endpoint/macos_keychains_dumped.yml create mode 100644 detections/endpoint/macos_log_removal.yml create mode 100644 detections/endpoint/macos_loginhook_persistence.yml create mode 100644 detections/endpoint/macos_network_share_discovery.yml create mode 100644 stories/macos_persistence_techniques.yml create mode 100644 stories/macos_post_exploitation.yml create mode 100644 stories/macos_privilege_escalation.yml diff --git a/detections/endpoint/macos_account_created.yml b/detections/endpoint/macos_account_created.yml new file mode 100644 index 0000000000..2e95bfd5ad --- /dev/null +++ b/detections/endpoint/macos_account_created.yml @@ -0,0 +1,51 @@ +name: MacOS Account Created +id: 491004ae-694f-453e-b1e0-fc1e65daeea1 +version: 1 +date: '2026-02-26' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: The following analytic detects the creation of a new local user account on a MacOS system. It leverages osquery logs to identify this activity. Monitoring the creation of local accounts is crucial for a SOC as it can indicate unauthorized access or lateral movement within the network. If confirmed malicious, this activity could allow an attacker to establish persistence, escalate privileges, or gain unauthorized access to sensitive systems and data. +data_source: + - osquery +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*sysadminctl","*createhomedir*","*dseditgroup*") OR (Processes.process = "*dscl*" AND Processes.process IN ("*-create*","*-passwd*")) by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_account_created_filter`' +how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://github.com/d1vious/TA-osquery) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +known_false_positives: Creating new accounts after initial endpoint management should be rare in most environments. +references: + - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ +drilldown_searches: + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: New local account created on $dest$ by $user$ + risk_objects: + - field: user + type: user + score: 18 + - field: dest + type: system + score: 18 + threat_objects: [] +tags: + analytic_story: + - MacOS Persistence Techniques + asset_type: Endpoint + mitre_attack_id: + - T1136 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136/osquery_account_creation/osquery.log + source: osquery + sourcetype: osquery:results diff --git a/detections/endpoint/macos_data_chunking.yml b/detections/endpoint/macos_data_chunking.yml new file mode 100644 index 0000000000..7ce264e8c5 --- /dev/null +++ b/detections/endpoint/macos_data_chunking.yml @@ -0,0 +1,51 @@ +name: MacOS Data Chunking +id: 7f1c8bed-9bd4-40b0-a1df-c262cbade0fc +version: 1 +date: '2026-02-26' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: The following analytic detects suspicious data chunking activities that involve the use of split or dd, potentially indicating an attempt to evade detection by breaking large files into smaller parts. Attackers may use this technique to bypass size-based security controls, facilitating the covert exfiltration of sensitive data. By monitoring for unusual or unauthorized use of these commands, this analytic helps identify potential data exfiltration attempts, allowing security teams to intervene and prevent the unauthorized transfer of critical information from the network. +data_source: + - osquery +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("dd *","*split *") by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_data_chunking_filter`' +how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://github.com/d1vious/TA-osquery) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. +references: + - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ +drilldown_searches: + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: A file was split on $dest$ by $user$ + risk_objects: + - field: user + type: user + score: 49 + - field: dest + type: system + score: 49 + threat_objects: [] +tags: + analytic_story: + - MacOS Post-Exploitation + asset_type: Endpoint + mitre_attack_id: + - T1030 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1030/osquery_data_chunking/osquery.log + source: osquery + sourcetype: osquery:results diff --git a/detections/endpoint/macos_gatekeeper_bypass.yml b/detections/endpoint/macos_gatekeeper_bypass.yml new file mode 100644 index 0000000000..7004aa6f3e --- /dev/null +++ b/detections/endpoint/macos_gatekeeper_bypass.yml @@ -0,0 +1,53 @@ +name: MacOS Gatekeeper Bypass +id: 2c9346f3-bbeb-48ce-8411-fc13d09d83a5 +version: 1 +date: '2026-02-26' +author: Raven Tait, Splunk +status: production +type: TTP +description: Detects known MacOS security bypass techniques that may be used to enable malicious code execution. Specifically monitors for attempts to remove the com.apple.quarantine attribute using xattr, or to disable Gatekeeper protections via spctl --master-disable, both of which can allow untrusted or malicious applications to execute without standard system safeguards. +data_source: + - osquery +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*xattr*" AND Processes.process = "*com.apple.quarantine*") OR (Processes.process = "*spctl*" AND Processes.process = "*master-disable*") by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `macos_gatekeeper_bypass_filter`' +how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://github.com/d1vious/TA-osquery) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +known_false_positives: Administrators or power users may need to disable Gatekeeper to install unsigned tools. +references: + - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ +drilldown_searches: + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Attempt to bypass gatekeeper protections on $dest$ by $user$ + risk_objects: + - field: user + type: user + score: 55 + - field: dest + type: system + score: 55 + threat_objects: [] +tags: + analytic_story: + - MacOS Privilege Escalation + - MacOS Post-Exploitation + - MacOS Persistence Techniques + asset_type: Endpoint + mitre_attack_id: + - T1553.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1553.001/osquery_gatekeeper/osquery.log + source: osquery + sourcetype: osquery:results diff --git a/detections/endpoint/macos_hidden_files_and_directories.yml b/detections/endpoint/macos_hidden_files_and_directories.yml new file mode 100644 index 0000000000..2a02a3db84 --- /dev/null +++ b/detections/endpoint/macos_hidden_files_and_directories.yml @@ -0,0 +1,51 @@ +name: MacOS Hidden Files and Directories +id: 51c43b7b-e406-45d2-9bad-5c67f07e6528 +version: 1 +date: '2026-02-26' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: The following analytic detects suspicious creation of hidden files and directories, which may indicate an attacker's attempt to conceal malicious activities or unauthorized data. Hidden files and directories are often used to evade detection by security tools and administrators, providing a stealthy means for storing malware, logs, or sensitive information. By monitoring for unusual or unauthorized creation of hidden files and directories, this analytic helps identify potential attempts to hide or unauthorized creation of hidden files and directories, and helps identify potential attempts to hide malicious operations, enabling security teams to uncover and address hidden threats effectively. +data_source: + - osquery +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process="*chflags *" AND Processes.process="* hidden*") OR (Processes.process="*xattr *" AND Processes.process="* -c *") by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_hidden_files_and_directories_filter`' +how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://github.com/d1vious/TA-osquery) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +known_false_positives: Power users or developers utilizing build tools or CI/CD tools could trigger this activity. +references: + - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ +drilldown_searches: + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Attempt to hide files on $dest$ by $user$ + risk_objects: + - field: user + type: user + score: 35 + - field: dest + type: system + score: 35 + threat_objects: [] +tags: + analytic_story: + - MacOS Persistence Techniques + asset_type: Endpoint + mitre_attack_id: + - T1564.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1564.001/osquery_hidden_files/osquery.log + source: osquery + sourcetype: osquery:results diff --git a/detections/endpoint/macos_kextload_usage.yml b/detections/endpoint/macos_kextload_usage.yml new file mode 100644 index 0000000000..6bd53decda --- /dev/null +++ b/detections/endpoint/macos_kextload_usage.yml @@ -0,0 +1,52 @@ +name: MacOS Kextload Usage +id: 9d680775-84a6-4625-a8ea-8182b9427ce4 +version: 1 +date: '2026-02-26' +author: Raven Tait, Splunk +status: production +type: TTP +description: Detects execution of the kextload command on macOS systems. The kextload utility is used to manually load kernel extensions (KEXTs) into the macOS kernel, which can introduce privileged code at the kernel level. While legitimate for driver installation and system administration, misuse may indicate attempts to install unauthorized, malicious, or persistence-enabling kernel extensions. +data_source: + - osquery +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "kextload" by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_kextload_usage_filter`' +how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://github.com/d1vious/TA-osquery) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +known_false_positives: Administrators installing new drivers could use this application. +references: + - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ +drilldown_searches: + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Possible kernel extension loaded on $dest$ by $user$ + risk_objects: + - field: user + type: user + score: 55 + - field: dest + type: system + score: 55 + threat_objects: [] +tags: + analytic_story: + - MacOS Privilege Escalation + - MacOS Persistence Techniques + asset_type: Endpoint + mitre_attack_id: + - T1543 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543/osquery_ketxload/osquery.log + source: osquery + sourcetype: osquery:results diff --git a/detections/endpoint/macos_keychains_dumped.yml b/detections/endpoint/macos_keychains_dumped.yml new file mode 100644 index 0000000000..805352c755 --- /dev/null +++ b/detections/endpoint/macos_keychains_dumped.yml @@ -0,0 +1,51 @@ +name: MacOS Keychains Dumped +id: dcb45a09-5e6f-441e-b2f8-cbbf923e36d9 +version: 1 +date: '2026-02-24' +author: Raven Tait, Splunk +status: production +type: TTP +description: Detects command-line attempts to access or dump macOS Keychain files. Adversaries may use native utilities or direct file access to extract plaintext credentials from Keychain databases located in ~/Library/Keychains/ or /Library/Keychains/. This technique is commonly associated with post-exploitation credential harvesting, where an attacker with local access seeks to escalate privileges or move laterally by obtaining stored credentials for applications, Wi-Fi networks, and system services. +data_source: + - osquery +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*/library/keychains*","*keychaindump*") by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_keychains_dumped_filter`' +how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://github.com/d1vious/TA-osquery) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +known_false_positives: Administrators accessing keychain files for troubleshooting or endpoint management. +references: + - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ +drilldown_searches: + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Keychains dumped on $dest$ by $user$ + risk_objects: + - field: user + type: user + score: 55 + - field: dest + type: system + score: 55 + threat_objects: [] +tags: + analytic_story: + - MacOS Privilege Escalation + asset_type: Endpoint + mitre_attack_id: + - T1555.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555.001/osquery_keychains/osquery.log + source: osquery + sourcetype: osquery:results diff --git a/detections/endpoint/macos_log_removal.yml b/detections/endpoint/macos_log_removal.yml new file mode 100644 index 0000000000..8ea965fd01 --- /dev/null +++ b/detections/endpoint/macos_log_removal.yml @@ -0,0 +1,51 @@ +name: MacOS Log Removal +id: a7f2e891-3c4d-4a1b-9e6f-2b8d0c5a1f3e +version: 1 +date: '2026-02-27' +author: Raven Tait, Splunk +status: production +type: TTP +description: Detects the deletion or modification of logs on MacOS systems by identifying execution of the rm command with command-line arguments referencing system.log or audit-related paths. Adversaries may remove or alter log files to cover their tracks and hinder detection and forensic analysis. This behavior commonly occurs during post-exploitation cleanup. +data_source: + - osquery +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*rm *" AND Processes.process = "*system.log*") OR (Processes.process = "*audit*" AND Processes.process = "* -s *" AND Processes.process = "*system.log*") by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_log_removal_filter`' +how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://github.com/d1vious/TA-osquery) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +known_false_positives: Legitimate log rotation or administrative cleanup of system or audit logs. +references: + - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ +drilldown_searches: + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Log removal or modification on $dest$ by $user$ + risk_objects: + - field: user + type: user + score: 55 + - field: dest + type: system + score: 55 + threat_objects: [] +tags: + analytic_story: + - MacOS Post-Exploitation + asset_type: Endpoint + mitre_attack_id: + - T1070 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/osquery_log_removal/osquery.log + source: osquery + sourcetype: osquery:results diff --git a/detections/endpoint/macos_loginhook_persistence.yml b/detections/endpoint/macos_loginhook_persistence.yml new file mode 100644 index 0000000000..95af904982 --- /dev/null +++ b/detections/endpoint/macos_loginhook_persistence.yml @@ -0,0 +1,51 @@ +name: MacOS LoginHook Persistence +id: a04832e7-9d1d-49b1-a684-e31bcd775c77 +version: 1 +date: '2026-02-27' +author: Raven Tait, Splunk +status: production +type: TTP +description: Identifies attempts to configure a macOS LoginHook via the defaults utility. LoginHooks enable automatic execution of a script or program upon user login and have historically been abused for persistence. Creation or modification of this setting may indicate an attempt to establish startup execution outside standard LaunchAgent mechanisms. +data_source: + - osquery +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*defaults *" AND Processes.process = "*write*" AND Processes.process = "*loginwindow*" AND Processes.process = "*loginhook*" by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_loginhook_persistence_filter`' +how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://github.com/d1vious/TA-osquery) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +known_false_positives: This method is possibly still used by legacy enterprise management scripts. Update filter macro to remove false positives. +references: + - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ +drilldown_searches: + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Loginhook created on $dest$ by $user$ + risk_objects: + - field: user + type: user + score: 75 + - field: dest + type: system + score: 75 + threat_objects: [] +tags: + analytic_story: + - MacOS Post-Exploitation + asset_type: Endpoint + mitre_attack_id: + - T1037.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1037.002/osquery_logon_scripts/osquery.log + source: osquery + sourcetype: osquery:results diff --git a/detections/endpoint/macos_network_share_discovery.yml b/detections/endpoint/macos_network_share_discovery.yml new file mode 100644 index 0000000000..847b9aaca4 --- /dev/null +++ b/detections/endpoint/macos_network_share_discovery.yml @@ -0,0 +1,51 @@ +name: MacOS Network Share Discovery +id: a5f5fe52-8e50-4fb0-ad1b-780be6c0d857 +version: 1 +date: '2026-03-02' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: Identifies execution of network share enumeration commands (smbutil, showmount) that can be leveraged by adversaries to discover accessible SMB and NFS resources, supporting internal reconnaissance and potential lateral movement. +data_source: + - osquery +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*showmount *" OR Processes.process = "*smbutil *" by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_network_share_discovery_filter`' +how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://github.com/d1vious/TA-osquery) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +known_false_positives: Administrators may utilize these tools occasionaly for troubleshooting. +references: + - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ +drilldown_searches: + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Network share information enumerated on $dest$ by $user$ + risk_objects: + - field: user + type: user + score: 18 + - field: dest + type: system + score: 18 + threat_objects: [] +tags: + analytic_story: + - MacOS Post-Exploitation + asset_type: Endpoint + mitre_attack_id: + - T1135 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1135/osquery_share_discovery/osquery.log + source: osquery + sourcetype: osquery:results diff --git a/stories/macos_persistence_techniques.yml b/stories/macos_persistence_techniques.yml new file mode 100644 index 0000000000..595a4069fd --- /dev/null +++ b/stories/macos_persistence_techniques.yml @@ -0,0 +1,17 @@ +name: MacOS Persistence Techniques +id: 3fc4619d-4a13-45f8-95a2-51056e221a1c +version: 1 +status: production +date: '2026-02-26' +author: Raven Tait, Splunk +description: UPDATE_DESCRIPTION +narrative: UPDATE_NARRATIVE +references: [] +tags: + category: + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file diff --git a/stories/macos_post_exploitation.yml b/stories/macos_post_exploitation.yml new file mode 100644 index 0000000000..69950c88d0 --- /dev/null +++ b/stories/macos_post_exploitation.yml @@ -0,0 +1,17 @@ +name: MacOS Post-Exploitation +id: bae14f9c-929d-4e2b-8fe7-e4680e0edbbb +version: 1 +status: production +date: '2026-02-26' +author: Raven Tait, Splunk +description: This analytic story identifies popular MacOS post exploitation tools such as autoSUID, LinEnum, LinPEAS, Linux Exploit Suggesters, MimiPenguin. +narrative: These tools allow operators find possible exploits or paths for privilege escalation based on stored credentials, user permissions, kernel version and distro version. +references: [] +tags: + category: + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file diff --git a/stories/macos_privilege_escalation.yml b/stories/macos_privilege_escalation.yml new file mode 100644 index 0000000000..32f465a787 --- /dev/null +++ b/stories/macos_privilege_escalation.yml @@ -0,0 +1,17 @@ +name: MacOS Privilege Escalation +id: 67f1ebd1-7a3c-4e9b-bb74-9656425db3c4 +version: 1 +status: production +date: '2026-02-26' +author: Raven Tait, Splunk +description: UPDATE_DESCRIPTION +narrative: UPDATE_NARRATIVE +references: [] +tags: + category: + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection From e7b6b49e85fb51c5bb340a4d80d732a38b742d6b Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Tue, 31 Mar 2026 12:33:40 +0200 Subject: [PATCH 2/8] add osquery --- contentctl.yml | 8 +++++++- data_sources/osquery.yml | 5 ++++- 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/contentctl.yml b/contentctl.yml index 2ff72d4899..1616dc7c60 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -92,7 +92,7 @@ apps: version: 1.3.0 description: description of app hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-iis_130.tgz -- uid: 4242 +- uid: 6994 title: CCX Add-on for Suricata appid: SPLUNK_TA_FOR_SURICATA version: 1.0.1 @@ -262,6 +262,12 @@ apps: version: 0.1.2 description: description of app hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/mcp-ta_012.tgz +- uid: 8574 + title: TA-osquery + appid: ta-osquery + version: 1.0.4 + description: description of app + hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/ta-osquery_104.tgz githash: d6fac80e6d50ae06b40f91519a98489d4ce3a3fd test_data_caches: - base_url: https://media.githubusercontent.com/media/splunk/attack_data/master/ diff --git a/data_sources/osquery.yml b/data_sources/osquery.yml index b14df40563..41427983af 100644 --- a/data_sources/osquery.yml +++ b/data_sources/osquery.yml @@ -13,7 +13,10 @@ mitre_components: - Application Log Content source: osquery sourcetype: osquery:results -supported_TA: [] +supported_TA: +- name: TA-osquery + url: https://splunkbase.splunk.com/app/8574 + version: 1.0.4 fields: - _time - calendarTime From be66fa65f988e1e981f4696cb57b1a01433e3cfd Mon Sep 17 00:00:00 2001 From: Raven Tait Date: Tue, 31 Mar 2026 13:51:32 -0400 Subject: [PATCH 3/8] Update links and formatting --- detections/endpoint/macos_account_created.yml | 6 ++++-- detections/endpoint/macos_data_chunking.yml | 6 ++++-- detections/endpoint/macos_gatekeeper_bypass.yml | 8 +++++--- .../endpoint/macos_hidden_files_and_directories.yml | 6 ++++-- detections/endpoint/macos_kextload_usage.yml | 6 ++++-- detections/endpoint/macos_keychains_dumped.yml | 2 +- detections/endpoint/macos_log_removal.yml | 6 ++++-- detections/endpoint/macos_loginhook_persistence.yml | 6 ++++-- detections/endpoint/macos_network_share_discovery.yml | 6 ++++-- 9 files changed, 34 insertions(+), 18 deletions(-) diff --git a/detections/endpoint/macos_account_created.yml b/detections/endpoint/macos_account_created.yml index 2e95bfd5ad..7cfaf8291c 100644 --- a/detections/endpoint/macos_account_created.yml +++ b/detections/endpoint/macos_account_created.yml @@ -9,7 +9,7 @@ description: The following analytic detects the creation of a new local user acc data_source: - osquery search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*sysadminctl","*createhomedir*","*dseditgroup*") OR (Processes.process = "*dscl*" AND Processes.process IN ("*-create*","*-passwd*")) by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_account_created_filter`' -how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://github.com/d1vious/TA-osquery) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. known_false_positives: Creating new accounts after initial endpoint management should be rare in most environments. references: - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ @@ -31,7 +31,9 @@ rba: - field: dest type: system score: 18 - threat_objects: [] + threat_objects: + - field: process + type: process tags: analytic_story: - MacOS Persistence Techniques diff --git a/detections/endpoint/macos_data_chunking.yml b/detections/endpoint/macos_data_chunking.yml index 7ce264e8c5..0dd94822c1 100644 --- a/detections/endpoint/macos_data_chunking.yml +++ b/detections/endpoint/macos_data_chunking.yml @@ -9,7 +9,7 @@ description: The following analytic detects suspicious data chunking activities data_source: - osquery search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("dd *","*split *") by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_data_chunking_filter`' -how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://github.com/d1vious/TA-osquery) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ @@ -31,7 +31,9 @@ rba: - field: dest type: system score: 49 - threat_objects: [] + threat_objects: + - field: process + type: process tags: analytic_story: - MacOS Post-Exploitation diff --git a/detections/endpoint/macos_gatekeeper_bypass.yml b/detections/endpoint/macos_gatekeeper_bypass.yml index 7004aa6f3e..c3a2755d53 100644 --- a/detections/endpoint/macos_gatekeeper_bypass.yml +++ b/detections/endpoint/macos_gatekeeper_bypass.yml @@ -8,8 +8,8 @@ type: TTP description: Detects known MacOS security bypass techniques that may be used to enable malicious code execution. Specifically monitors for attempts to remove the com.apple.quarantine attribute using xattr, or to disable Gatekeeper protections via spctl --master-disable, both of which can allow untrusted or malicious applications to execute without standard system safeguards. data_source: - osquery -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*xattr*" AND Processes.process = "*com.apple.quarantine*") OR (Processes.process = "*spctl*" AND Processes.process = "*master-disable*") by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `macos_gatekeeper_bypass_filter`' -how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://github.com/d1vious/TA-osquery) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*xattr*" AND Processes.process = "*com.apple.quarantine*") OR (Processes.process = "*spctl*" AND Processes.process = "*master-disable*") by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_gatekeeper_bypass_filter`' +how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. known_false_positives: Administrators or power users may need to disable Gatekeeper to install unsigned tools. references: - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ @@ -31,7 +31,9 @@ rba: - field: dest type: system score: 55 - threat_objects: [] + threat_objects: + - field: process + type: process tags: analytic_story: - MacOS Privilege Escalation diff --git a/detections/endpoint/macos_hidden_files_and_directories.yml b/detections/endpoint/macos_hidden_files_and_directories.yml index 2a02a3db84..374a0b35dd 100644 --- a/detections/endpoint/macos_hidden_files_and_directories.yml +++ b/detections/endpoint/macos_hidden_files_and_directories.yml @@ -9,7 +9,7 @@ description: The following analytic detects suspicious creation of hidden files data_source: - osquery search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process="*chflags *" AND Processes.process="* hidden*") OR (Processes.process="*xattr *" AND Processes.process="* -c *") by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_hidden_files_and_directories_filter`' -how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://github.com/d1vious/TA-osquery) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. known_false_positives: Power users or developers utilizing build tools or CI/CD tools could trigger this activity. references: - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ @@ -31,7 +31,9 @@ rba: - field: dest type: system score: 35 - threat_objects: [] + threat_objects: + - field: process + type: process tags: analytic_story: - MacOS Persistence Techniques diff --git a/detections/endpoint/macos_kextload_usage.yml b/detections/endpoint/macos_kextload_usage.yml index 6bd53decda..c3a5b60234 100644 --- a/detections/endpoint/macos_kextload_usage.yml +++ b/detections/endpoint/macos_kextload_usage.yml @@ -9,7 +9,7 @@ description: Detects execution of the kextload command on macOS systems. The kex data_source: - osquery search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "kextload" by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_kextload_usage_filter`' -how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://github.com/d1vious/TA-osquery) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. known_false_positives: Administrators installing new drivers could use this application. references: - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ @@ -31,7 +31,9 @@ rba: - field: dest type: system score: 55 - threat_objects: [] + threat_objects: + - field: process + type: process tags: analytic_story: - MacOS Privilege Escalation diff --git a/detections/endpoint/macos_keychains_dumped.yml b/detections/endpoint/macos_keychains_dumped.yml index 805352c755..a78058c286 100644 --- a/detections/endpoint/macos_keychains_dumped.yml +++ b/detections/endpoint/macos_keychains_dumped.yml @@ -9,7 +9,7 @@ description: Detects command-line attempts to access or dump macOS Keychain file data_source: - osquery search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*/library/keychains*","*keychaindump*") by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_keychains_dumped_filter`' -how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://github.com/d1vious/TA-osquery) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. known_false_positives: Administrators accessing keychain files for troubleshooting or endpoint management. references: - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ diff --git a/detections/endpoint/macos_log_removal.yml b/detections/endpoint/macos_log_removal.yml index 8ea965fd01..90e8a530b7 100644 --- a/detections/endpoint/macos_log_removal.yml +++ b/detections/endpoint/macos_log_removal.yml @@ -9,7 +9,7 @@ description: Detects the deletion or modification of logs on MacOS systems by id data_source: - osquery search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*rm *" AND Processes.process = "*system.log*") OR (Processes.process = "*audit*" AND Processes.process = "* -s *" AND Processes.process = "*system.log*") by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_log_removal_filter`' -how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://github.com/d1vious/TA-osquery) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. known_false_positives: Legitimate log rotation or administrative cleanup of system or audit logs. references: - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ @@ -31,7 +31,9 @@ rba: - field: dest type: system score: 55 - threat_objects: [] + threat_objects: + - field: process + type: process tags: analytic_story: - MacOS Post-Exploitation diff --git a/detections/endpoint/macos_loginhook_persistence.yml b/detections/endpoint/macos_loginhook_persistence.yml index 95af904982..881d54b509 100644 --- a/detections/endpoint/macos_loginhook_persistence.yml +++ b/detections/endpoint/macos_loginhook_persistence.yml @@ -9,7 +9,7 @@ description: Identifies attempts to configure a macOS LoginHook via the defaults data_source: - osquery search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*defaults *" AND Processes.process = "*write*" AND Processes.process = "*loginwindow*" AND Processes.process = "*loginhook*" by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_loginhook_persistence_filter`' -how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://github.com/d1vious/TA-osquery) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. known_false_positives: This method is possibly still used by legacy enterprise management scripts. Update filter macro to remove false positives. references: - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ @@ -31,7 +31,9 @@ rba: - field: dest type: system score: 75 - threat_objects: [] + threat_objects: + - field: process + type: process tags: analytic_story: - MacOS Post-Exploitation diff --git a/detections/endpoint/macos_network_share_discovery.yml b/detections/endpoint/macos_network_share_discovery.yml index 847b9aaca4..44efb0cb20 100644 --- a/detections/endpoint/macos_network_share_discovery.yml +++ b/detections/endpoint/macos_network_share_discovery.yml @@ -9,7 +9,7 @@ description: Identifies execution of network share enumeration commands (smbutil data_source: - osquery search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*showmount *" OR Processes.process = "*smbutil *" by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_network_share_discovery_filter`' -how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://github.com/d1vious/TA-osquery) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. known_false_positives: Administrators may utilize these tools occasionaly for troubleshooting. references: - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ @@ -31,7 +31,9 @@ rba: - field: dest type: system score: 18 - threat_objects: [] + threat_objects: + - field: process + type: process tags: analytic_story: - MacOS Post-Exploitation From 807f84302bc6afd035cca2e7598568197bfb3ccd Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Mon, 13 Apr 2026 12:42:12 +0200 Subject: [PATCH 4/8] update datasource name --- data_sources/{osquery.yml => osquery_results.yml} | 6 +++--- detections/endpoint/macos_account_created.yml | 2 +- .../macos_amos_stealer___virtual_machine_check_activity.yml | 2 +- detections/endpoint/macos_data_chunking.yml | 2 +- detections/endpoint/macos_gatekeeper_bypass.yml | 2 +- detections/endpoint/macos_hidden_files_and_directories.yml | 2 +- detections/endpoint/macos_kextload_usage.yml | 2 +- detections/endpoint/macos_keychains_dumped.yml | 2 +- detections/endpoint/macos_log_removal.yml | 2 +- detections/endpoint/macos_loginhook_persistence.yml | 2 +- detections/endpoint/macos_lolbin.yml | 2 +- detections/endpoint/macos_network_share_discovery.yml | 2 +- detections/endpoint/macos_plutil.yml | 2 +- detections/endpoint/processes_tapping_keyboard_events.yml | 2 +- .../endpoint/suspicious_plistbuddy_usage_via_osquery.yml | 2 +- 15 files changed, 17 insertions(+), 17 deletions(-) rename data_sources/{osquery.yml => osquery_results.yml} (98%) diff --git a/data_sources/osquery.yml b/data_sources/osquery_results.yml similarity index 98% rename from data_sources/osquery.yml rename to data_sources/osquery_results.yml index 41427983af..a644252dce 100644 --- a/data_sources/osquery.yml +++ b/data_sources/osquery_results.yml @@ -1,7 +1,7 @@ -name: osquery +name: Osquery Results id: 7ec4d7c8-c1d0-423a-9169-261f6adb74c0 -version: 2 -date: '2025-01-23' +version: 3 +date: '2026-04-13' author: Patrick Bareiss, Splunk description: Logs system queries performed using osquery, including details about processes, file access, network activity, and system configurations. diff --git a/detections/endpoint/macos_account_created.yml b/detections/endpoint/macos_account_created.yml index 7cfaf8291c..6ccbb086b0 100644 --- a/detections/endpoint/macos_account_created.yml +++ b/detections/endpoint/macos_account_created.yml @@ -7,7 +7,7 @@ status: production type: Anomaly description: The following analytic detects the creation of a new local user account on a MacOS system. It leverages osquery logs to identify this activity. Monitoring the creation of local accounts is crucial for a SOC as it can indicate unauthorized access or lateral movement within the network. If confirmed malicious, this activity could allow an attacker to establish persistence, escalate privileges, or gain unauthorized access to sensitive systems and data. data_source: - - osquery + - Osquery Results search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*sysadminctl","*createhomedir*","*dseditgroup*") OR (Processes.process = "*dscl*" AND Processes.process IN ("*-create*","*-passwd*")) by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_account_created_filter`' how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. known_false_positives: Creating new accounts after initial endpoint management should be rare in most environments. diff --git a/detections/endpoint/macos_amos_stealer___virtual_machine_check_activity.yml b/detections/endpoint/macos_amos_stealer___virtual_machine_check_activity.yml index 95a2d93601..b015911c54 100644 --- a/detections/endpoint/macos_amos_stealer___virtual_machine_check_activity.yml +++ b/detections/endpoint/macos_amos_stealer___virtual_machine_check_activity.yml @@ -9,7 +9,7 @@ description: | The following analytic detects AMOS Stealer VM check activity on macOS. It leverages osquery to monitor process events and identifies the execution of the "osascript" command along with specific commandline strings. This activity is significant as AMOS stealer was seen using this pattern in order to check if the host is a Virtual Machine or not. If confirmed malicious, this behavior indicate that the host is already infected by the AMOS stealer, which could allow attackers to execute arbitrary code, escalate privileges, steal information, or persist within the environment, posing a significant security risk. data_source: - - osquery + - Osquery Results search: | `osquery_macro` name=es_process_events columns.cmdline="*osascript*" AND columns.cmdline="* -e *" AND columns.cmdline="*set*" AND columns.cmdline="*system_profiler*" AND columns.cmdline IN ("*VMware*", "*QEMU*") diff --git a/detections/endpoint/macos_data_chunking.yml b/detections/endpoint/macos_data_chunking.yml index 0dd94822c1..9befa0e9d0 100644 --- a/detections/endpoint/macos_data_chunking.yml +++ b/detections/endpoint/macos_data_chunking.yml @@ -7,7 +7,7 @@ status: production type: Anomaly description: The following analytic detects suspicious data chunking activities that involve the use of split or dd, potentially indicating an attempt to evade detection by breaking large files into smaller parts. Attackers may use this technique to bypass size-based security controls, facilitating the covert exfiltration of sensitive data. By monitoring for unusual or unauthorized use of these commands, this analytic helps identify potential data exfiltration attempts, allowing security teams to intervene and prevent the unauthorized transfer of critical information from the network. data_source: - - osquery + - Osquery Results search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("dd *","*split *") by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_data_chunking_filter`' how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. diff --git a/detections/endpoint/macos_gatekeeper_bypass.yml b/detections/endpoint/macos_gatekeeper_bypass.yml index c3a2755d53..5c0992ac33 100644 --- a/detections/endpoint/macos_gatekeeper_bypass.yml +++ b/detections/endpoint/macos_gatekeeper_bypass.yml @@ -7,7 +7,7 @@ status: production type: TTP description: Detects known MacOS security bypass techniques that may be used to enable malicious code execution. Specifically monitors for attempts to remove the com.apple.quarantine attribute using xattr, or to disable Gatekeeper protections via spctl --master-disable, both of which can allow untrusted or malicious applications to execute without standard system safeguards. data_source: - - osquery + - Osquery Results search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*xattr*" AND Processes.process = "*com.apple.quarantine*") OR (Processes.process = "*spctl*" AND Processes.process = "*master-disable*") by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_gatekeeper_bypass_filter`' how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. known_false_positives: Administrators or power users may need to disable Gatekeeper to install unsigned tools. diff --git a/detections/endpoint/macos_hidden_files_and_directories.yml b/detections/endpoint/macos_hidden_files_and_directories.yml index 374a0b35dd..f4ecf53bd6 100644 --- a/detections/endpoint/macos_hidden_files_and_directories.yml +++ b/detections/endpoint/macos_hidden_files_and_directories.yml @@ -7,7 +7,7 @@ status: production type: Anomaly description: The following analytic detects suspicious creation of hidden files and directories, which may indicate an attacker's attempt to conceal malicious activities or unauthorized data. Hidden files and directories are often used to evade detection by security tools and administrators, providing a stealthy means for storing malware, logs, or sensitive information. By monitoring for unusual or unauthorized creation of hidden files and directories, this analytic helps identify potential attempts to hide or unauthorized creation of hidden files and directories, and helps identify potential attempts to hide malicious operations, enabling security teams to uncover and address hidden threats effectively. data_source: - - osquery + - Osquery Results search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process="*chflags *" AND Processes.process="* hidden*") OR (Processes.process="*xattr *" AND Processes.process="* -c *") by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_hidden_files_and_directories_filter`' how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. known_false_positives: Power users or developers utilizing build tools or CI/CD tools could trigger this activity. diff --git a/detections/endpoint/macos_kextload_usage.yml b/detections/endpoint/macos_kextload_usage.yml index c3a5b60234..1dc6d045d7 100644 --- a/detections/endpoint/macos_kextload_usage.yml +++ b/detections/endpoint/macos_kextload_usage.yml @@ -7,7 +7,7 @@ status: production type: TTP description: Detects execution of the kextload command on macOS systems. The kextload utility is used to manually load kernel extensions (KEXTs) into the macOS kernel, which can introduce privileged code at the kernel level. While legitimate for driver installation and system administration, misuse may indicate attempts to install unauthorized, malicious, or persistence-enabling kernel extensions. data_source: - - osquery + - Osquery Results search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "kextload" by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_kextload_usage_filter`' how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. known_false_positives: Administrators installing new drivers could use this application. diff --git a/detections/endpoint/macos_keychains_dumped.yml b/detections/endpoint/macos_keychains_dumped.yml index a78058c286..4ca19c4334 100644 --- a/detections/endpoint/macos_keychains_dumped.yml +++ b/detections/endpoint/macos_keychains_dumped.yml @@ -7,7 +7,7 @@ status: production type: TTP description: Detects command-line attempts to access or dump macOS Keychain files. Adversaries may use native utilities or direct file access to extract plaintext credentials from Keychain databases located in ~/Library/Keychains/ or /Library/Keychains/. This technique is commonly associated with post-exploitation credential harvesting, where an attacker with local access seeks to escalate privileges or move laterally by obtaining stored credentials for applications, Wi-Fi networks, and system services. data_source: - - osquery + - Osquery Results search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*/library/keychains*","*keychaindump*") by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_keychains_dumped_filter`' how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. known_false_positives: Administrators accessing keychain files for troubleshooting or endpoint management. diff --git a/detections/endpoint/macos_log_removal.yml b/detections/endpoint/macos_log_removal.yml index 90e8a530b7..ad7cd3396e 100644 --- a/detections/endpoint/macos_log_removal.yml +++ b/detections/endpoint/macos_log_removal.yml @@ -7,7 +7,7 @@ status: production type: TTP description: Detects the deletion or modification of logs on MacOS systems by identifying execution of the rm command with command-line arguments referencing system.log or audit-related paths. Adversaries may remove or alter log files to cover their tracks and hinder detection and forensic analysis. This behavior commonly occurs during post-exploitation cleanup. data_source: - - osquery + - Osquery Results search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*rm *" AND Processes.process = "*system.log*") OR (Processes.process = "*audit*" AND Processes.process = "* -s *" AND Processes.process = "*system.log*") by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_log_removal_filter`' how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. known_false_positives: Legitimate log rotation or administrative cleanup of system or audit logs. diff --git a/detections/endpoint/macos_loginhook_persistence.yml b/detections/endpoint/macos_loginhook_persistence.yml index 881d54b509..89eed2f638 100644 --- a/detections/endpoint/macos_loginhook_persistence.yml +++ b/detections/endpoint/macos_loginhook_persistence.yml @@ -7,7 +7,7 @@ status: production type: TTP description: Identifies attempts to configure a macOS LoginHook via the defaults utility. LoginHooks enable automatic execution of a script or program upon user login and have historically been abused for persistence. Creation or modification of this setting may indicate an attempt to establish startup execution outside standard LaunchAgent mechanisms. data_source: - - osquery + - Osquery Results search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*defaults *" AND Processes.process = "*write*" AND Processes.process = "*loginwindow*" AND Processes.process = "*loginhook*" by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_loginhook_persistence_filter`' how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. known_false_positives: This method is possibly still used by legacy enterprise management scripts. Update filter macro to remove false positives. diff --git a/detections/endpoint/macos_lolbin.yml b/detections/endpoint/macos_lolbin.yml index 0226b077c3..34cd5464e9 100644 --- a/detections/endpoint/macos_lolbin.yml +++ b/detections/endpoint/macos_lolbin.yml @@ -7,7 +7,7 @@ status: production type: TTP description: The following analytic detects multiple executions of Living off the Land (LOLbin) binaries on macOS within a short period. It leverages osquery to monitor process events and identifies commands such as "find", "crontab", "screencapture", "openssl", "curl", "wget", "killall", and "funzip". This activity is significant as LOLbins are often used by attackers to perform malicious actions while evading detection. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, or persist within the environment, posing a significant security risk. data_source: - - osquery + - Osquery Results search: |- `osquery_macro` name=es_process_events columns.cmdline IN ("find*", "crontab*", "screencapture*", "openssl*", "curl*", "wget*", "killall*", "funzip*") | rename columns.* as * diff --git a/detections/endpoint/macos_network_share_discovery.yml b/detections/endpoint/macos_network_share_discovery.yml index 44efb0cb20..80b4599e41 100644 --- a/detections/endpoint/macos_network_share_discovery.yml +++ b/detections/endpoint/macos_network_share_discovery.yml @@ -7,7 +7,7 @@ status: production type: Anomaly description: Identifies execution of network share enumeration commands (smbutil, showmount) that can be leveraged by adversaries to discover accessible SMB and NFS resources, supporting internal reconnaissance and potential lateral movement. data_source: - - osquery + - Osquery Results search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*showmount *" OR Processes.process = "*smbutil *" by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_network_share_discovery_filter`' how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. known_false_positives: Administrators may utilize these tools occasionaly for troubleshooting. diff --git a/detections/endpoint/macos_plutil.yml b/detections/endpoint/macos_plutil.yml index bd8ed7ba39..d8cd6bbe0c 100644 --- a/detections/endpoint/macos_plutil.yml +++ b/detections/endpoint/macos_plutil.yml @@ -7,7 +7,7 @@ status: production type: TTP description: The following analytic detects the usage of the `plutil` command to modify plist files on macOS systems. It leverages osquery to monitor process events, specifically looking for executions of `/usr/bin/plutil`. This activity is significant because adversaries can use `plutil` to alter plist files, potentially adding malicious binaries or command-line arguments that execute upon user logon or system startup. If confirmed malicious, this could allow attackers to achieve persistence, execute arbitrary code, or escalate privileges, posing a significant threat to the system's security. data_source: - - osquery + - Osquery Results search: |- `osquery_macro` name=es_process_events columns.path=/usr/bin/plutil | rename columns.* as * diff --git a/detections/endpoint/processes_tapping_keyboard_events.yml b/detections/endpoint/processes_tapping_keyboard_events.yml index 4284d32364..789258b0a5 100644 --- a/detections/endpoint/processes_tapping_keyboard_events.yml +++ b/detections/endpoint/processes_tapping_keyboard_events.yml @@ -7,7 +7,7 @@ status: experimental type: TTP description: The following analytic detects processes on macOS systems that are tapping keyboard events, potentially monitoring all keystrokes made by a user. It leverages data from osquery results within the Alerts data model, focusing on specific process names and command lines. This activity is significant as it is a common technique used by Remote Access Trojans (RATs) to log keystrokes, posing a serious security risk. If confirmed malicious, this could lead to unauthorized access to sensitive information, including passwords and personal data, compromising the integrity and confidentiality of the system. data_source: - - osquery + - Osquery Results search: |- | from datamodel Alerts.Alerts | search app=osquery:results name=pack_osx-attacks_Keyboard_Event_Taps diff --git a/detections/endpoint/suspicious_plistbuddy_usage_via_osquery.yml b/detections/endpoint/suspicious_plistbuddy_usage_via_osquery.yml index f92630fb73..aaac6f6e59 100644 --- a/detections/endpoint/suspicious_plistbuddy_usage_via_osquery.yml +++ b/detections/endpoint/suspicious_plistbuddy_usage_via_osquery.yml @@ -7,7 +7,7 @@ status: experimental type: TTP description: The following analytic detects the use of the PlistBuddy utility on macOS to create or modify property list (.plist) files. It leverages OSQuery to monitor process events, specifically looking for commands that interact with LaunchAgents and set properties like RunAtLoad. This activity is significant because PlistBuddy can be used to establish persistence mechanisms, as seen in malware like Silver Sparrow. If confirmed malicious, this could allow an attacker to maintain persistence, execute arbitrary commands, and potentially escalate privileges on the compromised system. data_source: - - osquery + - Osquery Results search: |- `osquery_process` "columns.cmdline"="*LaunchAgents*" OR "columns.cmdline"="*RunAtLoad*" OR "columns.cmdline"="*true*" | `suspicious_plistbuddy_usage_via_osquery_filter` From e90bad410ec57c55c04a03b67452b57df15cf287 Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Mon, 13 Apr 2026 13:37:47 +0200 Subject: [PATCH 5/8] update formatting --- detections/endpoint/macos_account_created.yml | 44 +++++++++++++-- ...ealer___virtual_machine_check_activity.yml | 22 +++++--- detections/endpoint/macos_data_chunking.yml | 33 ++++++++++-- .../endpoint/macos_gatekeeper_bypass.yml | 46 +++++++++++++--- .../macos_hidden_files_and_directories.yml | 37 +++++++++++-- detections/endpoint/macos_kextload_usage.yml | 36 ++++++++++--- .../endpoint/macos_keychains_dumped.yml | 32 +++++++++-- detections/endpoint/macos_log_removal.yml | 41 ++++++++++++-- .../endpoint/macos_loginhook_persistence.yml | 35 ++++++++++-- detections/endpoint/macos_lolbin.yml | 54 ++++++++++++++----- .../macos_network_share_discovery.yml | 35 +++++++++--- 11 files changed, 353 insertions(+), 62 deletions(-) diff --git a/detections/endpoint/macos_account_created.yml b/detections/endpoint/macos_account_created.yml index 6ccbb086b0..e11679cf10 100644 --- a/detections/endpoint/macos_account_created.yml +++ b/detections/endpoint/macos_account_created.yml @@ -5,12 +5,48 @@ date: '2026-02-26' author: Raven Tait, Splunk status: production type: Anomaly -description: The following analytic detects the creation of a new local user account on a MacOS system. It leverages osquery logs to identify this activity. Monitoring the creation of local accounts is crucial for a SOC as it can indicate unauthorized access or lateral movement within the network. If confirmed malicious, this activity could allow an attacker to establish persistence, escalate privileges, or gain unauthorized access to sensitive systems and data. +description: |- + The following analytic detects the creation of a new local user account on a MacOS system. It leverages osquery logs to identify this activity. + Monitoring the creation of local accounts is crucial for a SOC as it can indicate unauthorized access or lateral movement within the network. + If confirmed malicious, this activity could allow an attacker to establish persistence, escalate privileges, or gain unauthorized access to sensitive systems and data. data_source: - Osquery Results -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*sysadminctl","*createhomedir*","*dseditgroup*") OR (Processes.process = "*dscl*" AND Processes.process IN ("*-create*","*-passwd*")) by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_account_created_filter`' -how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. -known_false_positives: Creating new accounts after initial endpoint management should be rare in most environments. +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + from datamodel=Endpoint.Processes where + + Processes.process IN ( + "*sysadminctl", + "*createhomedir*", + "*dseditgroup*" + ) + OR + ( + Processes.process = "*dscl*" + Processes.process IN ( + "*-create*", + "*-passwd*" + ) + ) + + by Processes.dest Processes.original_file_name Processes.parent_process_id + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id + Processes.process_current_directory Processes.process_name + Processes.process_path Processes.user Processes.user_id + Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `macos_account_created_filter` +how_to_implement: |- + This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. + Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +known_false_positives: |- + Creating new accounts after initial endpoint management should be rare in most environments. Investigate and tune as needed. references: - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ drilldown_searches: diff --git a/detections/endpoint/macos_amos_stealer___virtual_machine_check_activity.yml b/detections/endpoint/macos_amos_stealer___virtual_machine_check_activity.yml index b015911c54..184013301e 100644 --- a/detections/endpoint/macos_amos_stealer___virtual_machine_check_activity.yml +++ b/detections/endpoint/macos_amos_stealer___virtual_machine_check_activity.yml @@ -1,19 +1,27 @@ name: MacOS AMOS Stealer - Virtual Machine Check Activity id: 4e41ad21-9761-426d-8aa1-083712ff9f30 -version: 5 -date: '2026-03-10' +version: 6 +date: '2026-04-13' author: Nasreddine Bencherchali, Splunk, Alex Karkins status: production type: Anomaly description: | - The following analytic detects AMOS Stealer VM check activity on macOS. It leverages osquery to monitor process events and identifies the execution of the "osascript" command along with specific commandline strings. This activity is significant - as AMOS stealer was seen using this pattern in order to check if the host is a Virtual Machine or not. If confirmed malicious, this behavior indicate that the host is already infected by the AMOS stealer, which could allow attackers to execute arbitrary code, escalate privileges, steal information, or persist within the environment, posing a significant security risk. + The following analytic detects AMOS Stealer VM check activity on macOS. It leverages osquery to monitor process events and identifies the execution of the "osascript" command along with specific commandline strings. + This activity is significant as AMOS stealer was seen using this pattern in order to check if the host is a Virtual Machine or not. + If confirmed malicious, this behavior indicate that the host is already infected by the AMOS stealer, which could allow attackers to execute arbitrary code, escalate privileges, steal information, or persist within the environment, posing a significant security risk. data_source: - Osquery Results search: | - `osquery_macro` name=es_process_events - columns.cmdline="*osascript*" AND columns.cmdline="* -e *" AND columns.cmdline="*set*" AND columns.cmdline="*system_profiler*" AND columns.cmdline IN ("*VMware*", "*QEMU*") + `osquery_macro` + name=es_process_events + columns.cmdline="*osascript*" + columns.cmdline="* -e *" + columns.cmdline="*set*" + columns.cmdline="*system_profiler*" + columns.cmdline IN ("*VMware*", "*QEMU*") + | rename columns.* as * + | stats min(_time) as firstTime max(_time) as lastTime values(cmdline) as cmdline, values(pid) as pid, @@ -21,12 +29,14 @@ search: | values(path) as path, values(signing_id) as signing_id, by username host + | rename username as user, cmdline as process, parent as parent_process, path as process_path, host as dest + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_amos_stealer___virtual_machine_check_activity_filter` diff --git a/detections/endpoint/macos_data_chunking.yml b/detections/endpoint/macos_data_chunking.yml index 9befa0e9d0..c5c6405c32 100644 --- a/detections/endpoint/macos_data_chunking.yml +++ b/detections/endpoint/macos_data_chunking.yml @@ -5,12 +5,37 @@ date: '2026-02-26' author: Raven Tait, Splunk status: production type: Anomaly -description: The following analytic detects suspicious data chunking activities that involve the use of split or dd, potentially indicating an attempt to evade detection by breaking large files into smaller parts. Attackers may use this technique to bypass size-based security controls, facilitating the covert exfiltration of sensitive data. By monitoring for unusual or unauthorized use of these commands, this analytic helps identify potential data exfiltration attempts, allowing security teams to intervene and prevent the unauthorized transfer of critical information from the network. +description: |- + The following analytic detects suspicious data chunking activities that involve the use of split or dd, potentially indicating an attempt to evade detection by breaking large files into smaller parts. + Attackers may use this technique to bypass size-based security controls, facilitating the covert exfiltration of sensitive data. + By monitoring for unusual or unauthorized use of these commands, this analytic helps identify potential data exfiltration attempts, allowing security teams to intervene and prevent the unauthorized transfer of critical information from the network. data_source: - Osquery Results -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("dd *","*split *") by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_data_chunking_filter`' -how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. -known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + Processes.process IN ("dd *","*split *") + + by Processes.dest Processes.original_file_name Processes.parent_process_id + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id + Processes.process_current_directory Processes.process_name + Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `macos_data_chunking_filter` +how_to_implement: |- + This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. + Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +known_false_positives: |- + Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ drilldown_searches: diff --git a/detections/endpoint/macos_gatekeeper_bypass.yml b/detections/endpoint/macos_gatekeeper_bypass.yml index 5c0992ac33..56cd393378 100644 --- a/detections/endpoint/macos_gatekeeper_bypass.yml +++ b/detections/endpoint/macos_gatekeeper_bypass.yml @@ -4,13 +4,45 @@ version: 1 date: '2026-02-26' author: Raven Tait, Splunk status: production -type: TTP -description: Detects known MacOS security bypass techniques that may be used to enable malicious code execution. Specifically monitors for attempts to remove the com.apple.quarantine attribute using xattr, or to disable Gatekeeper protections via spctl --master-disable, both of which can allow untrusted or malicious applications to execute without standard system safeguards. +type: Anomaly +description: |- + Detects known MacOS security bypass techniques that may be used to enable malicious code execution. + Specifically monitors for attempts to remove the com.apple.quarantine attribute using xattr, or to disable Gatekeeper protections via spctl --master-disable, both of which can allow untrusted or malicious applications to execute without standard system safeguards. data_source: - Osquery Results -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*xattr*" AND Processes.process = "*com.apple.quarantine*") OR (Processes.process = "*spctl*" AND Processes.process = "*master-disable*") by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_gatekeeper_bypass_filter`' -how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. -known_false_positives: Administrators or power users may need to disable Gatekeeper to install unsigned tools. +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + ( + Processes.process = "*xattr*" + Processes.process = "*com.apple.quarantine*" + ) + OR + ( + Processes.process = "*spctl*" + Processes.process = "*master-disable*" + ) + + by Processes.dest Processes.original_file_name Processes.parent_process_id + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id + Processes.process_current_directory Processes.process_name + Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `macos_gatekeeper_bypass_filter` +how_to_implement: |- + This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. + Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +known_false_positives: |- + Administrators or power users may need to disable Gatekeeper to install unsigned tools. references: - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ drilldown_searches: @@ -27,10 +59,10 @@ rba: risk_objects: - field: user type: user - score: 55 + score: 20 - field: dest type: system - score: 55 + score: 20 threat_objects: - field: process type: process diff --git a/detections/endpoint/macos_hidden_files_and_directories.yml b/detections/endpoint/macos_hidden_files_and_directories.yml index f4ecf53bd6..8a4c815c41 100644 --- a/detections/endpoint/macos_hidden_files_and_directories.yml +++ b/detections/endpoint/macos_hidden_files_and_directories.yml @@ -5,12 +5,41 @@ date: '2026-02-26' author: Raven Tait, Splunk status: production type: Anomaly -description: The following analytic detects suspicious creation of hidden files and directories, which may indicate an attacker's attempt to conceal malicious activities or unauthorized data. Hidden files and directories are often used to evade detection by security tools and administrators, providing a stealthy means for storing malware, logs, or sensitive information. By monitoring for unusual or unauthorized creation of hidden files and directories, this analytic helps identify potential attempts to hide or unauthorized creation of hidden files and directories, and helps identify potential attempts to hide malicious operations, enabling security teams to uncover and address hidden threats effectively. +description: |- + The following analytic detects suspicious creation of hidden files and directories, which may indicate an attacker's attempt to conceal malicious activities or unauthorized data. + Hidden files and directories are often used to evade detection by security tools and administrators, providing a stealthy means for storing malware, logs, or sensitive information. + By monitoring for unusual or unauthorized creation of hidden files and directories, this analytic helps identify potential attempts to hide or unauthorized creation of hidden files and directories, and helps identify potential attempts to hide malicious operations, enabling security teams to uncover and address hidden threats effectively. data_source: - Osquery Results -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process="*chflags *" AND Processes.process="* hidden*") OR (Processes.process="*xattr *" AND Processes.process="* -c *") by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_hidden_files_and_directories_filter`' -how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. -known_false_positives: Power users or developers utilizing build tools or CI/CD tools could trigger this activity. +search: |- + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where + + ( + Processes.process="*chflags *" + Processes.process="* hidden*" + ) + OR + ( + Processes.process="*xattr *" + Processes.process="* -c *" + ) + + by Processes.dest Processes.original_file_name Processes.parent_process_id + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id + Processes.process_current_directory Processes.process_name + Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `macos_hidden_files_and_directories_filter` +how_to_implement: |- + This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. + Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +known_false_positives: |- + Power users or developers utilizing build tools or CI/CD tools could trigger this activity. references: - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ drilldown_searches: diff --git a/detections/endpoint/macos_kextload_usage.yml b/detections/endpoint/macos_kextload_usage.yml index 1dc6d045d7..9cccc371f2 100644 --- a/detections/endpoint/macos_kextload_usage.yml +++ b/detections/endpoint/macos_kextload_usage.yml @@ -5,12 +5,36 @@ date: '2026-02-26' author: Raven Tait, Splunk status: production type: TTP -description: Detects execution of the kextload command on macOS systems. The kextload utility is used to manually load kernel extensions (KEXTs) into the macOS kernel, which can introduce privileged code at the kernel level. While legitimate for driver installation and system administration, misuse may indicate attempts to install unauthorized, malicious, or persistence-enabling kernel extensions. +description: |- + Detects execution of the kextload command on macOS systems. The kextload utility is used to manually load kernel extensions (KEXTs) into the macOS kernel, which can introduce privileged code at the kernel level. + While legitimate for driver installation and system administration, misuse may indicate attempts to install unauthorized, malicious, or persistence-enabling kernel extensions. data_source: - Osquery Results -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "kextload" by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_kextload_usage_filter`' -how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. -known_false_positives: Administrators installing new drivers could use this application. +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + Processes.process_name = "kextload" + + by Processes.dest Processes.original_file_name Processes.parent_process_id + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id + Processes.process_current_directory Processes.process_name + Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `macos_kextload_usage_filter` +how_to_implement: |- + This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. + Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +known_false_positives: |- + Administrators installing new drivers could use this application. references: - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ drilldown_searches: @@ -27,10 +51,10 @@ rba: risk_objects: - field: user type: user - score: 55 + score: 50 - field: dest type: system - score: 55 + score: 50 threat_objects: - field: process type: process diff --git a/detections/endpoint/macos_keychains_dumped.yml b/detections/endpoint/macos_keychains_dumped.yml index 4ca19c4334..96f44bdbd5 100644 --- a/detections/endpoint/macos_keychains_dumped.yml +++ b/detections/endpoint/macos_keychains_dumped.yml @@ -5,12 +5,36 @@ date: '2026-02-24' author: Raven Tait, Splunk status: production type: TTP -description: Detects command-line attempts to access or dump macOS Keychain files. Adversaries may use native utilities or direct file access to extract plaintext credentials from Keychain databases located in ~/Library/Keychains/ or /Library/Keychains/. This technique is commonly associated with post-exploitation credential harvesting, where an attacker with local access seeks to escalate privileges or move laterally by obtaining stored credentials for applications, Wi-Fi networks, and system services. +description: |- + Detects command-line attempts to access or dump macOS Keychain files. Adversaries may use native utilities or direct file access to extract plaintext credentials from Keychain databases located in ~/Library/Keychains/ or /Library/Keychains/. + This technique is commonly associated with post-exploitation credential harvesting, where an attacker with local access seeks to escalate privileges or move laterally by obtaining stored credentials for applications, Wi-Fi networks, and system services. data_source: - Osquery Results -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*/library/keychains*","*keychaindump*") by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_keychains_dumped_filter`' -how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. -known_false_positives: Administrators accessing keychain files for troubleshooting or endpoint management. +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + Processes.process IN ("*/library/keychains*","*keychaindump*") + + by Processes.dest Processes.original_file_name Processes.parent_process_id + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id + Processes.process_current_directory Processes.process_name + Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `macos_keychains_dumped_filter` +how_to_implement: |- + This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. + Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +known_false_positives: |- + Administrators accessing keychain files for troubleshooting or endpoint management. references: - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ drilldown_searches: diff --git a/detections/endpoint/macos_log_removal.yml b/detections/endpoint/macos_log_removal.yml index ad7cd3396e..c439fc7248 100644 --- a/detections/endpoint/macos_log_removal.yml +++ b/detections/endpoint/macos_log_removal.yml @@ -5,12 +5,45 @@ date: '2026-02-27' author: Raven Tait, Splunk status: production type: TTP -description: Detects the deletion or modification of logs on MacOS systems by identifying execution of the rm command with command-line arguments referencing system.log or audit-related paths. Adversaries may remove or alter log files to cover their tracks and hinder detection and forensic analysis. This behavior commonly occurs during post-exploitation cleanup. +description: |- + Detects the deletion or modification of logs on MacOS systems by identifying execution of the rm command with command-line arguments referencing system.log or audit-related paths. + Adversaries may remove or alter log files to cover their tracks and hinder detection and forensic analysis. This behavior commonly occurs during post-exploitation cleanup. data_source: - Osquery Results -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*rm *" AND Processes.process = "*system.log*") OR (Processes.process = "*audit*" AND Processes.process = "* -s *" AND Processes.process = "*system.log*") by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_log_removal_filter`' -how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. -known_false_positives: Legitimate log rotation or administrative cleanup of system or audit logs. +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + Processes.process = "*system.log*" + AND + ( + (Processes.process = "*rm *") + OR + ( + Processes.process = "*audit*" + Processes.process = "* -s *" + ) + ) + + by Processes.dest Processes.original_file_name Processes.parent_process_id + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id + Processes.process_current_directory Processes.process_name + Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `macos_log_removal_filter` +how_to_implement: |- + This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. + Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +known_false_positives: |- + Legitimate log rotation or administrative cleanup of system or audit logs. references: - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ drilldown_searches: diff --git a/detections/endpoint/macos_loginhook_persistence.yml b/detections/endpoint/macos_loginhook_persistence.yml index 89eed2f638..ae19d5b4b2 100644 --- a/detections/endpoint/macos_loginhook_persistence.yml +++ b/detections/endpoint/macos_loginhook_persistence.yml @@ -5,12 +5,39 @@ date: '2026-02-27' author: Raven Tait, Splunk status: production type: TTP -description: Identifies attempts to configure a macOS LoginHook via the defaults utility. LoginHooks enable automatic execution of a script or program upon user login and have historically been abused for persistence. Creation or modification of this setting may indicate an attempt to establish startup execution outside standard LaunchAgent mechanisms. +description: |- + Identifies attempts to configure a macOS LoginHook via the defaults utility. LoginHooks enable automatic execution of a script or program upon user login and have historically been abused for persistence. + Creation or modification of this setting may indicate an attempt to establish startup execution outside standard LaunchAgent mechanisms. data_source: - Osquery Results -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*defaults *" AND Processes.process = "*write*" AND Processes.process = "*loginwindow*" AND Processes.process = "*loginhook*" by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_loginhook_persistence_filter`' -how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. -known_false_positives: This method is possibly still used by legacy enterprise management scripts. Update filter macro to remove false positives. +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + Processes.process = "*defaults *" + Processes.process = "*write*" + Processes.process = "*loginwindow*" + Processes.process = "*loginhook*" + + by Processes.dest Processes.original_file_name Processes.parent_process_id + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id + Processes.process_current_directory Processes.process_name + Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `macos_loginhook_persistence_filter` +how_to_implement: |- + This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. + Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +known_false_positives: |- + This method is possibly still used by legacy enterprise management scripts. Update filter macro to remove false positives. references: - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ drilldown_searches: diff --git a/detections/endpoint/macos_lolbin.yml b/detections/endpoint/macos_lolbin.yml index 34cd5464e9..8b1375e707 100644 --- a/detections/endpoint/macos_lolbin.yml +++ b/detections/endpoint/macos_lolbin.yml @@ -1,25 +1,53 @@ name: MacOS LOLbin id: 58d270fb-5b39-418e-a855-4b8ac046805e -version: 11 -date: '2026-03-10' +version: 12 +date: '2026-04-13' author: Patrick Bareiss, Splunk status: production type: TTP -description: The following analytic detects multiple executions of Living off the Land (LOLbin) binaries on macOS within a short period. It leverages osquery to monitor process events and identifies commands such as "find", "crontab", "screencapture", "openssl", "curl", "wget", "killall", and "funzip". This activity is significant as LOLbins are often used by attackers to perform malicious actions while evading detection. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, or persist within the environment, posing a significant security risk. +description: |- + The following analytic detects multiple executions of Living off the Land (LOLbin) binaries on macOS within a short period. + It leverages osquery to monitor process events and identifies commands such as "find", "crontab", "screencapture", "openssl", "curl", "wget", "killall", and "funzip". This activity is significant as LOLbins are often used by attackers to perform malicious actions while evading detection. + If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, or persist within the environment, posing a significant security risk. data_source: - Osquery Results search: |- - `osquery_macro` name=es_process_events columns.cmdline IN ("find*", "crontab*", "screencapture*", "openssl*", "curl*", "wget*", "killall*", "funzip*") - | rename columns.* as * - | stats min(_time) as firstTime max(_time) as lastTime values(cmdline) as cmdline, values(pid) as pid, values(parent) as parent, values(path) as path, values(signing_id) as signing_id, dc(path) as dc_path + `osquery_macro` + name=es_process_events + columns.cmdline IN ( + "find*", + "crontab*", + "screencapture*", + "openssl*", + "curl*", + "wget*", + "killall*", + "funzip*" + ) + | rename columns.* as * + | stats count min(_time) as firstTime + max(_time) as lastTime + values(cmdline) as cmdline + values(pid) as pid + values(parent) as parent + values(path) as path + values(signing_id) as signing_id + dc(path) as dc_path BY username host - | rename username as user, cmdline as process, path as process_path, host as dest - | where dc_path > 3 - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `macos_lolbin_filter` -how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. -known_false_positives: No false positives have been identified at this time. + + | rename username as user + cmdline as process + path as process_path + host as dest + + | where dc_path > 3 + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `macos_lolbin_filter` +how_to_implement: |- + This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. +known_false_positives: |- + No false positives have been identified at this time. references: - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ drilldown_searches: diff --git a/detections/endpoint/macos_network_share_discovery.yml b/detections/endpoint/macos_network_share_discovery.yml index 80b4599e41..d80e4b862f 100644 --- a/detections/endpoint/macos_network_share_discovery.yml +++ b/detections/endpoint/macos_network_share_discovery.yml @@ -5,12 +5,35 @@ date: '2026-03-02' author: Raven Tait, Splunk status: production type: Anomaly -description: Identifies execution of network share enumeration commands (smbutil, showmount) that can be leveraged by adversaries to discover accessible SMB and NFS resources, supporting internal reconnaissance and potential lateral movement. +description: |- + Identifies execution of network share enumeration commands (smbutil, showmount) that can be leveraged by adversaries to discover accessible SMB and NFS resources, supporting internal reconnaissance and potential lateral movement. data_source: - Osquery Results -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*showmount *" OR Processes.process = "*smbutil *" by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_network_share_discovery_filter`' -how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. -known_false_positives: Administrators may utilize these tools occasionaly for troubleshooting. +search: |- + | tstats `security_content_summariesonly` + count min(_time) as firstTime + max(_time) as lastTime + + from datamodel=Endpoint.Processes where + + Processes.process IN ("*showmount *", "*smbutil *") + + by Processes.dest Processes.original_file_name Processes.parent_process_id + Processes.process Processes.process_exec Processes.process_guid + Processes.process_hash Processes.process_id + Processes.process_current_directory Processes.process_name + Processes.process_path Processes.user + Processes.user_id Processes.vendor_product + + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `macos_network_share_discovery_filter` +how_to_implement: |- + This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. + Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +known_false_positives: |- + Administrators may utilize these tools occasionaly for troubleshooting. references: - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ drilldown_searches: @@ -27,10 +50,10 @@ rba: risk_objects: - field: user type: user - score: 18 + score: 20 - field: dest type: system - score: 18 + score: 20 threat_objects: - field: process type: process From eabbcc520677114848a2925e495a88d4b27f638d Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Mon, 13 Apr 2026 13:39:07 +0200 Subject: [PATCH 6/8] bump version --- detections/endpoint/macos_plutil.yml | 4 ++-- detections/endpoint/processes_tapping_keyboard_events.yml | 4 ++-- .../endpoint/suspicious_plistbuddy_usage_via_osquery.yml | 4 ++-- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/macos_plutil.yml b/detections/endpoint/macos_plutil.yml index d8cd6bbe0c..26bfc902a3 100644 --- a/detections/endpoint/macos_plutil.yml +++ b/detections/endpoint/macos_plutil.yml @@ -1,7 +1,7 @@ name: MacOS plutil id: c11f2b57-92c1-4cd2-b46c-064eafb833ac -version: 9 -date: '2026-03-10' +version: 10 +date: '2026-04-13' author: Patrick Bareiss, Splunk status: production type: TTP diff --git a/detections/endpoint/processes_tapping_keyboard_events.yml b/detections/endpoint/processes_tapping_keyboard_events.yml index 789258b0a5..f09d8861bc 100644 --- a/detections/endpoint/processes_tapping_keyboard_events.yml +++ b/detections/endpoint/processes_tapping_keyboard_events.yml @@ -1,7 +1,7 @@ name: Processes Tapping Keyboard Events id: 2a371608-331d-4034-ae2c-21dda8f1d0ec -version: 10 -date: '2026-03-10' +version: 11 +date: '2026-04-13' author: Jose Hernandez, Splunk status: experimental type: TTP diff --git a/detections/endpoint/suspicious_plistbuddy_usage_via_osquery.yml b/detections/endpoint/suspicious_plistbuddy_usage_via_osquery.yml index aaac6f6e59..1ac24de917 100644 --- a/detections/endpoint/suspicious_plistbuddy_usage_via_osquery.yml +++ b/detections/endpoint/suspicious_plistbuddy_usage_via_osquery.yml @@ -1,7 +1,7 @@ name: Suspicious PlistBuddy Usage via OSquery id: 20ba6c32-c733-4a32-b64e-2688cf231399 -version: 10 -date: '2026-03-10' +version: 11 +date: '2026-04-13' author: Michael Haag, Splunk status: experimental type: TTP From d48c95debd9fc526608e764de21cec9ee0eadcd8 Mon Sep 17 00:00:00 2001 From: Raven Tait Date: Mon, 13 Apr 2026 12:42:19 -0400 Subject: [PATCH 7/8] Updates per PR comments --- detections/endpoint/macos_account_created.yml | 34 +++++++++++++------ detections/endpoint/macos_data_chunking.yml | 18 +++++++--- .../endpoint/macos_gatekeeper_bypass.yml | 2 ++ .../macos_hidden_files_and_directories.yml | 11 +++--- detections/endpoint/macos_kextload_usage.yml | 10 +++++- .../endpoint/macos_keychains_dumped.yml | 15 +++++--- .../endpoint/macos_loginhook_persistence.yml | 7 ++-- .../macos_network_share_discovery.yml | 4 ++- stories/macos_persistence_techniques.yml | 13 +++++-- stories/macos_post_exploitation.yml | 9 +++-- stories/macos_privilege_escalation.yml | 16 +++++++-- 11 files changed, 103 insertions(+), 36 deletions(-) diff --git a/detections/endpoint/macos_account_created.yml b/detections/endpoint/macos_account_created.yml index e11679cf10..d51159959d 100644 --- a/detections/endpoint/macos_account_created.yml +++ b/detections/endpoint/macos_account_created.yml @@ -17,18 +17,27 @@ search: |- max(_time) as lastTime from datamodel=Endpoint.Processes where - Processes.process IN ( - "*sysadminctl", - "*createhomedir*", - "*dseditgroup*" + ( + Processes.process = "*sysadminctl" + Processes.process = "*-addUser*" ) OR ( - Processes.process = "*dscl*" + Processes.process = "*createhomedir*" + Processes.process = "*-u*" + ) + OR + ( + Processes.process = "*dseditgroup*" Processes.process IN ( - "*-create*", - "*-passwd*" - ) + "*edit*", + "*-a*" + ) + ) + OR + ( + Processes.process = "*dscl*" + Processes.process = "*-create*" ) by Processes.dest Processes.original_file_name Processes.parent_process_id @@ -49,6 +58,9 @@ known_false_positives: |- Creating new accounts after initial endpoint management should be rare in most environments. Investigate and tune as needed. references: - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ + - https://ss64.com/mac/sysadminctl.html + - https://ss64.com/mac/dseditgroup.html + - https://ss64.com/mac/dscl.html drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -59,14 +71,14 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: New local account created on $dest$ by $user$ + message: New local account created on $dest$ by $user$ via $process$ risk_objects: - field: user type: user - score: 18 + score: 20 - field: dest type: system - score: 18 + score: 20 threat_objects: - field: process type: process diff --git a/detections/endpoint/macos_data_chunking.yml b/detections/endpoint/macos_data_chunking.yml index c5c6405c32..dd1fcc8497 100644 --- a/detections/endpoint/macos_data_chunking.yml +++ b/detections/endpoint/macos_data_chunking.yml @@ -18,7 +18,15 @@ search: |- from datamodel=Endpoint.Processes where - Processes.process IN ("dd *","*split *") + ( + Processes.process = "dd *" + Processes.process = "* if=*" + ) + OR + ( + Processes.process = "*split *" + Processes.process="* -b *" + ) by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid @@ -38,6 +46,8 @@ known_false_positives: |- Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ + - https://ss64.com/mac/dd.html + - https://ss64.com/mac/split.html drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -48,14 +58,14 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: A file was split on $dest$ by $user$ + message: A file was split on $dest$ by $user$ via $process$ risk_objects: - field: user type: user - score: 49 + score: 20 - field: dest type: system - score: 49 + score: 20 threat_objects: - field: process type: process diff --git a/detections/endpoint/macos_gatekeeper_bypass.yml b/detections/endpoint/macos_gatekeeper_bypass.yml index 56cd393378..e999626a11 100644 --- a/detections/endpoint/macos_gatekeeper_bypass.yml +++ b/detections/endpoint/macos_gatekeeper_bypass.yml @@ -45,6 +45,8 @@ known_false_positives: |- Administrators or power users may need to disable Gatekeeper to install unsigned tools. references: - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ + - https://ss64.com/mac/xattr.html + - https://ss64.com/mac/spctl.html drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' diff --git a/detections/endpoint/macos_hidden_files_and_directories.yml b/detections/endpoint/macos_hidden_files_and_directories.yml index 8a4c815c41..04b3eaf05e 100644 --- a/detections/endpoint/macos_hidden_files_and_directories.yml +++ b/detections/endpoint/macos_hidden_files_and_directories.yml @@ -21,7 +21,8 @@ search: |- OR ( Processes.process="*xattr *" - Processes.process="* -c *" + Processes.process="* -wx *" + Processes.process="*com.apple.FinderInfo*" ) by Processes.dest Processes.original_file_name Processes.parent_process_id @@ -42,6 +43,8 @@ known_false_positives: |- Power users or developers utilizing build tools or CI/CD tools could trigger this activity. references: - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ + - https://ss64.com/mac/chflags.html + - https://ss64.com/mac/xattr.html drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -52,14 +55,14 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Attempt to hide files on $dest$ by $user$ + message: Attempt to hide files on $dest$ by $user$ via $process$ risk_objects: - field: user type: user - score: 35 + score: 20 - field: dest type: system - score: 35 + score: 20 threat_objects: - field: process type: process diff --git a/detections/endpoint/macos_kextload_usage.yml b/detections/endpoint/macos_kextload_usage.yml index 9cccc371f2..2f60c09536 100644 --- a/detections/endpoint/macos_kextload_usage.yml +++ b/detections/endpoint/macos_kextload_usage.yml @@ -19,6 +19,13 @@ search: |- Processes.process_name = "kextload" + AND NOT + + Processes.process IN ( + "*-help*", + "* -h *" + ) + by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id @@ -37,6 +44,7 @@ known_false_positives: |- Administrators installing new drivers could use this application. references: - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ + - https://www.unix.com/man_page/osx/8/kextload/ drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -47,7 +55,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Possible kernel extension loaded on $dest$ by $user$ + message: Possible kernel extension loaded on $dest$ by $user$ via $process$ risk_objects: - field: user type: user diff --git a/detections/endpoint/macos_keychains_dumped.yml b/detections/endpoint/macos_keychains_dumped.yml index 96f44bdbd5..13a94790d8 100644 --- a/detections/endpoint/macos_keychains_dumped.yml +++ b/detections/endpoint/macos_keychains_dumped.yml @@ -17,7 +17,12 @@ search: |- from datamodel=Endpoint.Processes where - Processes.process IN ("*/library/keychains*","*keychaindump*") + Processes.process IN ( + "*dump-keychain -d*", + "*keychaindump*" + ) + + Processes.process="*/library/keychains*" by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid @@ -37,6 +42,8 @@ known_false_positives: |- Administrators accessing keychain files for troubleshooting or endpoint management. references: - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ + - https://gist.github.com/hfeeki/88c12f01d00534e09a84 + - https://ss64.com/mac/security-keychain-settings.html drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -47,14 +54,14 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Keychains dumped on $dest$ by $user$ + message: Keychains dumped on $dest$ by $user$ via $process$ risk_objects: - field: user type: user - score: 55 + score: 50 - field: dest type: system - score: 55 + score: 50 threat_objects: [] tags: analytic_story: diff --git a/detections/endpoint/macos_loginhook_persistence.yml b/detections/endpoint/macos_loginhook_persistence.yml index ae19d5b4b2..18e9679136 100644 --- a/detections/endpoint/macos_loginhook_persistence.yml +++ b/detections/endpoint/macos_loginhook_persistence.yml @@ -40,6 +40,7 @@ known_false_positives: |- This method is possibly still used by legacy enterprise management scripts. Update filter macro to remove false positives. references: - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ + - https://www.loobins.io/binaries/defaults/ drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -50,14 +51,14 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Loginhook created on $dest$ by $user$ + message: Loginhook created on $dest$ by $user$ via $process$ risk_objects: - field: user type: user - score: 75 + score: 50 - field: dest type: system - score: 75 + score: 50 threat_objects: - field: process type: process diff --git a/detections/endpoint/macos_network_share_discovery.yml b/detections/endpoint/macos_network_share_discovery.yml index d80e4b862f..64ae1383d5 100644 --- a/detections/endpoint/macos_network_share_discovery.yml +++ b/detections/endpoint/macos_network_share_discovery.yml @@ -36,6 +36,8 @@ known_false_positives: |- Administrators may utilize these tools occasionaly for troubleshooting. references: - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ + - https://leopard-adc.pepas.com/documentation/Darwin/Reference/ManPages/man8/showmount.8.html + - https://www.unix.com/man_page/osx/1/smbutil/ drilldown_searches: - name: View the detection results for - "$user$" and "$dest$" search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' @@ -46,7 +48,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Network share information enumerated on $dest$ by $user$ + message: Network share information enumerated on $dest$ by $user$ via $process$ risk_objects: - field: user type: user diff --git a/stories/macos_persistence_techniques.yml b/stories/macos_persistence_techniques.yml index 595a4069fd..ea0e4464b9 100644 --- a/stories/macos_persistence_techniques.yml +++ b/stories/macos_persistence_techniques.yml @@ -4,9 +4,16 @@ version: 1 status: production date: '2026-02-26' author: Raven Tait, Splunk -description: UPDATE_DESCRIPTION -narrative: UPDATE_NARRATIVE -references: [] +description: Monitor for activities and techniques associated with maintaining persistence + on a MacOS system--a sign that an adversary may have compromised your environment. +narrative: Maintaining persistence is one of the first steps taken by attackers after + the initial compromise. Attackers leverage various custom and built-in tools to + ensure survivability and persistent access within a compromised enterprise. This + Analytic Story provides searches to help you identify various behaviors used by + attackers to maintain persistent access to a MacOS environment. +references: +- https://attack.mitre.org/techniques/T1053/ +- https://www.loobins.io/binaries/defaults/ tags: category: - Adversary Tactics diff --git a/stories/macos_post_exploitation.yml b/stories/macos_post_exploitation.yml index 69950c88d0..a50d6e05d8 100644 --- a/stories/macos_post_exploitation.yml +++ b/stories/macos_post_exploitation.yml @@ -4,9 +4,14 @@ version: 1 status: production date: '2026-02-26' author: Raven Tait, Splunk -description: This analytic story identifies popular MacOS post exploitation tools such as autoSUID, LinEnum, LinPEAS, Linux Exploit Suggesters, MimiPenguin. +description: This analytic story identifies popular MacOS post exploitation tools such as MacPEAS, MacShellSwift, EvilOSX, chainbreaker, etc narrative: These tools allow operators find possible exploits or paths for privilege escalation based on stored credentials, user permissions, kernel version and distro version. -references: [] +references: +- https://attack.mitre.org/matrices/enterprise/macos/ +- https://github.com/UnsaltedHash42/macPEAS +- https://github.com/cedowens/MacShellSwift/tree/master/MacShellSwift +- https://github.com/Marten4n6/EvilOSX +- https://github.com/n0fate/chainbreaker tags: category: - Adversary Tactics diff --git a/stories/macos_privilege_escalation.yml b/stories/macos_privilege_escalation.yml index 32f465a787..e798356557 100644 --- a/stories/macos_privilege_escalation.yml +++ b/stories/macos_privilege_escalation.yml @@ -4,9 +4,19 @@ version: 1 status: production date: '2026-02-26' author: Raven Tait, Splunk -description: UPDATE_DESCRIPTION -narrative: UPDATE_NARRATIVE -references: [] +description: Monitor for and investigate activities that may be associated with a + MacOS privilege-escalation attack, including unusual processes running on endpoints, + schedule task, services, setuid, root execution and more. +narrative: 'Privilege escalation is a "land-and-expand" technique, wherein an adversary + gains an initial foothold on a host and then exploits its weaknesses to increase + his privileges. The motivation is simple: certain actions on a MacOS machine--such + as installing software--may require higher-level privileges than those the attacker + initially acquired. By increasing his privilege level, the attacker can gain the + control required to carry out his malicious ends. This Analytic Story provides searches + to detect and investigate behaviors that attackers may use to elevate their privileges + in your environment.' +references: +- https://attack.mitre.org/tactics/TA0004/ tags: category: - Adversary Tactics From b9072e0d776f447bfcf1a023dcfe9da0bf3c65e5 Mon Sep 17 00:00:00 2001 From: Raven Tait Date: Mon, 13 Apr 2026 12:45:46 -0400 Subject: [PATCH 8/8] Add commandline to RBA for gatekeeper bypass --- detections/endpoint/macos_gatekeeper_bypass.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/macos_gatekeeper_bypass.yml b/detections/endpoint/macos_gatekeeper_bypass.yml index e999626a11..f12a1001f8 100644 --- a/detections/endpoint/macos_gatekeeper_bypass.yml +++ b/detections/endpoint/macos_gatekeeper_bypass.yml @@ -57,7 +57,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Attempt to bypass gatekeeper protections on $dest$ by $user$ + message: Attempt to bypass gatekeeper protections on $dest$ by $user$ via $process$ risk_objects: - field: user type: user