-
Notifications
You must be signed in to change notification settings - Fork 453
Snap Mac Detections #3935
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Snap Mac Detections #3935
Changes from all commits
Commits
Show all changes
10 commits
Select commit
Hold shift + click to select a range
b8aa737
Snap Mac Detections
RavenTait 33e1cea
Merge branch 'develop' into mac_from_snap
nasbench e7b6b49
add osquery
nasbench be66fa6
Update links and formatting
RavenTait 807f843
update datasource name
nasbench e90bad4
update formatting
nasbench eabbcc5
bump version
nasbench c919e64
Merge branch 'develop' into mac_from_snap
nasbench d48c95d
Updates per PR comments
RavenTait b9072e0
Add commandline to RBA for gatekeeper bypass
RavenTait File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,101 @@ | ||
| name: MacOS Account Created | ||
| id: 491004ae-694f-453e-b1e0-fc1e65daeea1 | ||
| version: 1 | ||
| date: '2026-02-26' | ||
| author: Raven Tait, Splunk | ||
| status: production | ||
| type: Anomaly | ||
| description: |- | ||
| The following analytic detects the creation of a new local user account on a MacOS system. It leverages osquery logs to identify this activity. | ||
| Monitoring the creation of local accounts is crucial for a SOC as it can indicate unauthorized access or lateral movement within the network. | ||
| If confirmed malicious, this activity could allow an attacker to establish persistence, escalate privileges, or gain unauthorized access to sensitive systems and data. | ||
| data_source: | ||
| - Osquery Results | ||
| search: |- | ||
| | tstats `security_content_summariesonly` | ||
| count min(_time) as firstTime | ||
| max(_time) as lastTime | ||
| from datamodel=Endpoint.Processes where | ||
|
|
||
| ( | ||
| Processes.process = "*sysadminctl" | ||
| Processes.process = "*-addUser*" | ||
| ) | ||
| OR | ||
| ( | ||
| Processes.process = "*createhomedir*" | ||
| Processes.process = "*-u*" | ||
| ) | ||
| OR | ||
| ( | ||
| Processes.process = "*dseditgroup*" | ||
| Processes.process IN ( | ||
| "*edit*", | ||
| "*-a*" | ||
| ) | ||
| ) | ||
| OR | ||
| ( | ||
| Processes.process = "*dscl*" | ||
| Processes.process = "*-create*" | ||
| ) | ||
|
|
||
| by Processes.dest Processes.original_file_name Processes.parent_process_id | ||
| Processes.process Processes.process_exec Processes.process_guid | ||
| Processes.process_hash Processes.process_id | ||
| Processes.process_current_directory Processes.process_name | ||
| Processes.process_path Processes.user Processes.user_id | ||
| Processes.vendor_product | ||
|
|
||
| | `drop_dm_object_name(Processes)` | ||
| | `security_content_ctime(firstTime)` | ||
| | `security_content_ctime(lastTime)` | ||
| | `macos_account_created_filter` | ||
| how_to_implement: |- | ||
| This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. | ||
| Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. | ||
| known_false_positives: |- | ||
| Creating new accounts after initial endpoint management should be rare in most environments. Investigate and tune as needed. | ||
| references: | ||
| - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ | ||
| - https://ss64.com/mac/sysadminctl.html | ||
| - https://ss64.com/mac/dseditgroup.html | ||
| - https://ss64.com/mac/dscl.html | ||
| drilldown_searches: | ||
| - name: View the detection results for - "$user$" and "$dest$" | ||
| search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' | ||
| earliest_offset: $info_min_time$ | ||
| latest_offset: $info_max_time$ | ||
| - name: View risk events for the last 7 days for - "$user$" and "$dest$" | ||
| search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' | ||
| earliest_offset: $info_min_time$ | ||
| latest_offset: $info_max_time$ | ||
| rba: | ||
| message: New local account created on $dest$ by $user$ via $process$ | ||
| risk_objects: | ||
| - field: user | ||
| type: user | ||
| score: 20 | ||
| - field: dest | ||
| type: system | ||
| score: 20 | ||
| threat_objects: | ||
| - field: process | ||
| type: process | ||
| tags: | ||
| analytic_story: | ||
| - MacOS Persistence Techniques | ||
| asset_type: Endpoint | ||
| mitre_attack_id: | ||
| - T1136 | ||
| product: | ||
| - Splunk Enterprise | ||
| - Splunk Enterprise Security | ||
| - Splunk Cloud | ||
| security_domain: endpoint | ||
| tests: | ||
| - name: True Positive Test | ||
| attack_data: | ||
| - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136/osquery_account_creation/osquery.log | ||
| source: osquery | ||
| sourcetype: osquery:results | ||
24 changes: 17 additions & 7 deletions
24
detections/endpoint/macos_amos_stealer___virtual_machine_check_activity.yml
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,88 @@ | ||
| name: MacOS Data Chunking | ||
| id: 7f1c8bed-9bd4-40b0-a1df-c262cbade0fc | ||
| version: 1 | ||
| date: '2026-02-26' | ||
| author: Raven Tait, Splunk | ||
| status: production | ||
| type: Anomaly | ||
| description: |- | ||
| The following analytic detects suspicious data chunking activities that involve the use of split or dd, potentially indicating an attempt to evade detection by breaking large files into smaller parts. | ||
| Attackers may use this technique to bypass size-based security controls, facilitating the covert exfiltration of sensitive data. | ||
| By monitoring for unusual or unauthorized use of these commands, this analytic helps identify potential data exfiltration attempts, allowing security teams to intervene and prevent the unauthorized transfer of critical information from the network. | ||
| data_source: | ||
| - Osquery Results | ||
| search: |- | ||
| | tstats `security_content_summariesonly` | ||
| count min(_time) as firstTime | ||
| max(_time) as lastTime | ||
|
|
||
| from datamodel=Endpoint.Processes where | ||
|
|
||
| ( | ||
| Processes.process = "dd *" | ||
| Processes.process = "* if=*" | ||
| ) | ||
| OR | ||
| ( | ||
| Processes.process = "*split *" | ||
| Processes.process="* -b *" | ||
| ) | ||
|
|
||
| by Processes.dest Processes.original_file_name Processes.parent_process_id | ||
| Processes.process Processes.process_exec Processes.process_guid | ||
| Processes.process_hash Processes.process_id | ||
| Processes.process_current_directory Processes.process_name | ||
| Processes.process_path Processes.user | ||
| Processes.user_id Processes.vendor_product | ||
|
|
||
| | `drop_dm_object_name(Processes)` | ||
| | `security_content_ctime(firstTime)` | ||
| | `security_content_ctime(lastTime)` | ||
| | `macos_data_chunking_filter` | ||
| how_to_implement: |- | ||
| This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. | ||
| Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. | ||
| known_false_positives: |- | ||
| Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. | ||
| references: | ||
| - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ | ||
|
RavenTait marked this conversation as resolved.
|
||
| - https://ss64.com/mac/dd.html | ||
| - https://ss64.com/mac/split.html | ||
| drilldown_searches: | ||
| - name: View the detection results for - "$user$" and "$dest$" | ||
| search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' | ||
| earliest_offset: $info_min_time$ | ||
| latest_offset: $info_max_time$ | ||
| - name: View risk events for the last 7 days for - "$user$" and "$dest$" | ||
| search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' | ||
| earliest_offset: $info_min_time$ | ||
| latest_offset: $info_max_time$ | ||
| rba: | ||
| message: A file was split on $dest$ by $user$ via $process$ | ||
| risk_objects: | ||
| - field: user | ||
| type: user | ||
| score: 20 | ||
| - field: dest | ||
| type: system | ||
| score: 20 | ||
| threat_objects: | ||
| - field: process | ||
| type: process | ||
| tags: | ||
| analytic_story: | ||
| - MacOS Post-Exploitation | ||
| asset_type: Endpoint | ||
| mitre_attack_id: | ||
| - T1030 | ||
| product: | ||
| - Splunk Enterprise | ||
| - Splunk Enterprise Security | ||
| - Splunk Cloud | ||
| security_domain: endpoint | ||
| tests: | ||
| - name: True Positive Test | ||
| attack_data: | ||
| - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1030/osquery_data_chunking/osquery.log | ||
| source: osquery | ||
| sourcetype: osquery:results | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,89 @@ | ||
| name: MacOS Gatekeeper Bypass | ||
| id: 2c9346f3-bbeb-48ce-8411-fc13d09d83a5 | ||
| version: 1 | ||
| date: '2026-02-26' | ||
| author: Raven Tait, Splunk | ||
| status: production | ||
| type: Anomaly | ||
| description: |- | ||
| Detects known MacOS security bypass techniques that may be used to enable malicious code execution. | ||
| Specifically monitors for attempts to remove the com.apple.quarantine attribute using xattr, or to disable Gatekeeper protections via spctl --master-disable, both of which can allow untrusted or malicious applications to execute without standard system safeguards. | ||
| data_source: | ||
| - Osquery Results | ||
| search: |- | ||
| | tstats `security_content_summariesonly` | ||
| count min(_time) as firstTime | ||
| max(_time) as lastTime | ||
|
|
||
| from datamodel=Endpoint.Processes where | ||
|
|
||
| ( | ||
| Processes.process = "*xattr*" | ||
| Processes.process = "*com.apple.quarantine*" | ||
| ) | ||
| OR | ||
| ( | ||
| Processes.process = "*spctl*" | ||
| Processes.process = "*master-disable*" | ||
| ) | ||
|
|
||
| by Processes.dest Processes.original_file_name Processes.parent_process_id | ||
| Processes.process Processes.process_exec Processes.process_guid | ||
| Processes.process_hash Processes.process_id | ||
| Processes.process_current_directory Processes.process_name | ||
| Processes.process_path Processes.user | ||
| Processes.user_id Processes.vendor_product | ||
|
|
||
| | `drop_dm_object_name(Processes)` | ||
| | `security_content_ctime(firstTime)` | ||
| | `security_content_ctime(lastTime)` | ||
| | `macos_gatekeeper_bypass_filter` | ||
| how_to_implement: |- | ||
| This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. | ||
| Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. | ||
| known_false_positives: |- | ||
| Administrators or power users may need to disable Gatekeeper to install unsigned tools. | ||
| references: | ||
| - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ | ||
|
RavenTait marked this conversation as resolved.
|
||
| - https://ss64.com/mac/xattr.html | ||
| - https://ss64.com/mac/spctl.html | ||
| drilldown_searches: | ||
| - name: View the detection results for - "$user$" and "$dest$" | ||
| search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' | ||
| earliest_offset: $info_min_time$ | ||
| latest_offset: $info_max_time$ | ||
| - name: View risk events for the last 7 days for - "$user$" and "$dest$" | ||
| search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' | ||
| earliest_offset: $info_min_time$ | ||
| latest_offset: $info_max_time$ | ||
| rba: | ||
| message: Attempt to bypass gatekeeper protections on $dest$ by $user$ via $process$ | ||
| risk_objects: | ||
| - field: user | ||
| type: user | ||
| score: 20 | ||
| - field: dest | ||
| type: system | ||
| score: 20 | ||
| threat_objects: | ||
| - field: process | ||
| type: process | ||
| tags: | ||
| analytic_story: | ||
| - MacOS Privilege Escalation | ||
| - MacOS Post-Exploitation | ||
| - MacOS Persistence Techniques | ||
| asset_type: Endpoint | ||
| mitre_attack_id: | ||
| - T1553.001 | ||
| product: | ||
| - Splunk Enterprise | ||
| - Splunk Enterprise Security | ||
| - Splunk Cloud | ||
| security_domain: endpoint | ||
| tests: | ||
| - name: True Positive Test | ||
| attack_data: | ||
| - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1553.001/osquery_gatekeeper/osquery.log | ||
| source: osquery | ||
| sourcetype: osquery:results | ||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.