From b8aa73764b15cb15b97e129cba43747475c7019c Mon Sep 17 00:00:00 2001 From: Raven Tait Date: Tue, 3 Mar 2026 14:52:00 -0500 Subject: [PATCH] Snap Mac Detections --- detections/endpoint/macos_account_created.yml | 51 ++++++++++++++++++ detections/endpoint/macos_data_chunking.yml | 51 ++++++++++++++++++ .../endpoint/macos_gatekeeper_bypass.yml | 53 +++++++++++++++++++ .../macos_hidden_files_and_directories.yml | 51 ++++++++++++++++++ detections/endpoint/macos_kextload_usage.yml | 52 ++++++++++++++++++ .../endpoint/macos_keychains_dumped.yml | 51 ++++++++++++++++++ detections/endpoint/macos_log_removal.yml | 51 ++++++++++++++++++ .../endpoint/macos_loginhook_persistence.yml | 51 ++++++++++++++++++ .../macos_network_share_discovery.yml | 51 ++++++++++++++++++ stories/macos_persistence_techniques.yml | 17 ++++++ stories/macos_post_exploitation.yml | 17 ++++++ stories/macos_privilege_escalation.yml | 17 ++++++ 12 files changed, 513 insertions(+) create mode 100644 detections/endpoint/macos_account_created.yml create mode 100644 detections/endpoint/macos_data_chunking.yml create mode 100644 detections/endpoint/macos_gatekeeper_bypass.yml create mode 100644 detections/endpoint/macos_hidden_files_and_directories.yml create mode 100644 detections/endpoint/macos_kextload_usage.yml create mode 100644 detections/endpoint/macos_keychains_dumped.yml create mode 100644 detections/endpoint/macos_log_removal.yml create mode 100644 detections/endpoint/macos_loginhook_persistence.yml create mode 100644 detections/endpoint/macos_network_share_discovery.yml create mode 100644 stories/macos_persistence_techniques.yml create mode 100644 stories/macos_post_exploitation.yml create mode 100644 stories/macos_privilege_escalation.yml diff --git a/detections/endpoint/macos_account_created.yml b/detections/endpoint/macos_account_created.yml new file mode 100644 index 0000000000..2e95bfd5ad --- /dev/null +++ b/detections/endpoint/macos_account_created.yml @@ -0,0 +1,51 @@ +name: MacOS Account Created +id: 491004ae-694f-453e-b1e0-fc1e65daeea1 +version: 1 +date: '2026-02-26' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: The following analytic detects the creation of a new local user account on a MacOS system. It leverages osquery logs to identify this activity. Monitoring the creation of local accounts is crucial for a SOC as it can indicate unauthorized access or lateral movement within the network. If confirmed malicious, this activity could allow an attacker to establish persistence, escalate privileges, or gain unauthorized access to sensitive systems and data. +data_source: + - osquery +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*sysadminctl","*createhomedir*","*dseditgroup*") OR (Processes.process = "*dscl*" AND Processes.process IN ("*-create*","*-passwd*")) by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_account_created_filter`' +how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://github.com/d1vious/TA-osquery) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +known_false_positives: Creating new accounts after initial endpoint management should be rare in most environments. +references: + - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ +drilldown_searches: + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: New local account created on $dest$ by $user$ + risk_objects: + - field: user + type: user + score: 18 + - field: dest + type: system + score: 18 + threat_objects: [] +tags: + analytic_story: + - MacOS Persistence Techniques + asset_type: Endpoint + mitre_attack_id: + - T1136 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136/osquery_account_creation/osquery.log + source: osquery + sourcetype: osquery:results diff --git a/detections/endpoint/macos_data_chunking.yml b/detections/endpoint/macos_data_chunking.yml new file mode 100644 index 0000000000..7ce264e8c5 --- /dev/null +++ b/detections/endpoint/macos_data_chunking.yml @@ -0,0 +1,51 @@ +name: MacOS Data Chunking +id: 7f1c8bed-9bd4-40b0-a1df-c262cbade0fc +version: 1 +date: '2026-02-26' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: The following analytic detects suspicious data chunking activities that involve the use of split or dd, potentially indicating an attempt to evade detection by breaking large files into smaller parts. Attackers may use this technique to bypass size-based security controls, facilitating the covert exfiltration of sensitive data. By monitoring for unusual or unauthorized use of these commands, this analytic helps identify potential data exfiltration attempts, allowing security teams to intervene and prevent the unauthorized transfer of critical information from the network. +data_source: + - osquery +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("dd *","*split *") by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_data_chunking_filter`' +how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://github.com/d1vious/TA-osquery) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. +references: + - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ +drilldown_searches: + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: A file was split on $dest$ by $user$ + risk_objects: + - field: user + type: user + score: 49 + - field: dest + type: system + score: 49 + threat_objects: [] +tags: + analytic_story: + - MacOS Post-Exploitation + asset_type: Endpoint + mitre_attack_id: + - T1030 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1030/osquery_data_chunking/osquery.log + source: osquery + sourcetype: osquery:results diff --git a/detections/endpoint/macos_gatekeeper_bypass.yml b/detections/endpoint/macos_gatekeeper_bypass.yml new file mode 100644 index 0000000000..7004aa6f3e --- /dev/null +++ b/detections/endpoint/macos_gatekeeper_bypass.yml @@ -0,0 +1,53 @@ +name: MacOS Gatekeeper Bypass +id: 2c9346f3-bbeb-48ce-8411-fc13d09d83a5 +version: 1 +date: '2026-02-26' +author: Raven Tait, Splunk +status: production +type: TTP +description: Detects known MacOS security bypass techniques that may be used to enable malicious code execution. Specifically monitors for attempts to remove the com.apple.quarantine attribute using xattr, or to disable Gatekeeper protections via spctl --master-disable, both of which can allow untrusted or malicious applications to execute without standard system safeguards. +data_source: + - osquery +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*xattr*" AND Processes.process = "*com.apple.quarantine*") OR (Processes.process = "*spctl*" AND Processes.process = "*master-disable*") by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `macos_gatekeeper_bypass_filter`' +how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://github.com/d1vious/TA-osquery) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +known_false_positives: Administrators or power users may need to disable Gatekeeper to install unsigned tools. +references: + - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ +drilldown_searches: + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Attempt to bypass gatekeeper protections on $dest$ by $user$ + risk_objects: + - field: user + type: user + score: 55 + - field: dest + type: system + score: 55 + threat_objects: [] +tags: + analytic_story: + - MacOS Privilege Escalation + - MacOS Post-Exploitation + - MacOS Persistence Techniques + asset_type: Endpoint + mitre_attack_id: + - T1553.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1553.001/osquery_gatekeeper/osquery.log + source: osquery + sourcetype: osquery:results diff --git a/detections/endpoint/macos_hidden_files_and_directories.yml b/detections/endpoint/macos_hidden_files_and_directories.yml new file mode 100644 index 0000000000..2a02a3db84 --- /dev/null +++ b/detections/endpoint/macos_hidden_files_and_directories.yml @@ -0,0 +1,51 @@ +name: MacOS Hidden Files and Directories +id: 51c43b7b-e406-45d2-9bad-5c67f07e6528 +version: 1 +date: '2026-02-26' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: The following analytic detects suspicious creation of hidden files and directories, which may indicate an attacker's attempt to conceal malicious activities or unauthorized data. Hidden files and directories are often used to evade detection by security tools and administrators, providing a stealthy means for storing malware, logs, or sensitive information. By monitoring for unusual or unauthorized creation of hidden files and directories, this analytic helps identify potential attempts to hide or unauthorized creation of hidden files and directories, and helps identify potential attempts to hide malicious operations, enabling security teams to uncover and address hidden threats effectively. +data_source: + - osquery +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process="*chflags *" AND Processes.process="* hidden*") OR (Processes.process="*xattr *" AND Processes.process="* -c *") by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_hidden_files_and_directories_filter`' +how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://github.com/d1vious/TA-osquery) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +known_false_positives: Power users or developers utilizing build tools or CI/CD tools could trigger this activity. +references: + - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ +drilldown_searches: + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Attempt to hide files on $dest$ by $user$ + risk_objects: + - field: user + type: user + score: 35 + - field: dest + type: system + score: 35 + threat_objects: [] +tags: + analytic_story: + - MacOS Persistence Techniques + asset_type: Endpoint + mitre_attack_id: + - T1564.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1564.001/osquery_hidden_files/osquery.log + source: osquery + sourcetype: osquery:results diff --git a/detections/endpoint/macos_kextload_usage.yml b/detections/endpoint/macos_kextload_usage.yml new file mode 100644 index 0000000000..6bd53decda --- /dev/null +++ b/detections/endpoint/macos_kextload_usage.yml @@ -0,0 +1,52 @@ +name: MacOS Kextload Usage +id: 9d680775-84a6-4625-a8ea-8182b9427ce4 +version: 1 +date: '2026-02-26' +author: Raven Tait, Splunk +status: production +type: TTP +description: Detects execution of the kextload command on macOS systems. The kextload utility is used to manually load kernel extensions (KEXTs) into the macOS kernel, which can introduce privileged code at the kernel level. While legitimate for driver installation and system administration, misuse may indicate attempts to install unauthorized, malicious, or persistence-enabling kernel extensions. +data_source: + - osquery +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "kextload" by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_kextload_usage_filter`' +how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://github.com/d1vious/TA-osquery) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +known_false_positives: Administrators installing new drivers could use this application. +references: + - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ +drilldown_searches: + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Possible kernel extension loaded on $dest$ by $user$ + risk_objects: + - field: user + type: user + score: 55 + - field: dest + type: system + score: 55 + threat_objects: [] +tags: + analytic_story: + - MacOS Privilege Escalation + - MacOS Persistence Techniques + asset_type: Endpoint + mitre_attack_id: + - T1543 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543/osquery_ketxload/osquery.log + source: osquery + sourcetype: osquery:results diff --git a/detections/endpoint/macos_keychains_dumped.yml b/detections/endpoint/macos_keychains_dumped.yml new file mode 100644 index 0000000000..805352c755 --- /dev/null +++ b/detections/endpoint/macos_keychains_dumped.yml @@ -0,0 +1,51 @@ +name: MacOS Keychains Dumped +id: dcb45a09-5e6f-441e-b2f8-cbbf923e36d9 +version: 1 +date: '2026-02-24' +author: Raven Tait, Splunk +status: production +type: TTP +description: Detects command-line attempts to access or dump macOS Keychain files. Adversaries may use native utilities or direct file access to extract plaintext credentials from Keychain databases located in ~/Library/Keychains/ or /Library/Keychains/. This technique is commonly associated with post-exploitation credential harvesting, where an attacker with local access seeks to escalate privileges or move laterally by obtaining stored credentials for applications, Wi-Fi networks, and system services. +data_source: + - osquery +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*/library/keychains*","*keychaindump*") by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_keychains_dumped_filter`' +how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://github.com/d1vious/TA-osquery) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +known_false_positives: Administrators accessing keychain files for troubleshooting or endpoint management. +references: + - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ +drilldown_searches: + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Keychains dumped on $dest$ by $user$ + risk_objects: + - field: user + type: user + score: 55 + - field: dest + type: system + score: 55 + threat_objects: [] +tags: + analytic_story: + - MacOS Privilege Escalation + asset_type: Endpoint + mitre_attack_id: + - T1555.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555.001/osquery_keychains/osquery.log + source: osquery + sourcetype: osquery:results diff --git a/detections/endpoint/macos_log_removal.yml b/detections/endpoint/macos_log_removal.yml new file mode 100644 index 0000000000..8ea965fd01 --- /dev/null +++ b/detections/endpoint/macos_log_removal.yml @@ -0,0 +1,51 @@ +name: MacOS Log Removal +id: a7f2e891-3c4d-4a1b-9e6f-2b8d0c5a1f3e +version: 1 +date: '2026-02-27' +author: Raven Tait, Splunk +status: production +type: TTP +description: Detects the deletion or modification of logs on MacOS systems by identifying execution of the rm command with command-line arguments referencing system.log or audit-related paths. Adversaries may remove or alter log files to cover their tracks and hinder detection and forensic analysis. This behavior commonly occurs during post-exploitation cleanup. +data_source: + - osquery +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*rm *" AND Processes.process = "*system.log*") OR (Processes.process = "*audit*" AND Processes.process = "* -s *" AND Processes.process = "*system.log*") by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_log_removal_filter`' +how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://github.com/d1vious/TA-osquery) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +known_false_positives: Legitimate log rotation or administrative cleanup of system or audit logs. +references: + - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ +drilldown_searches: + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Log removal or modification on $dest$ by $user$ + risk_objects: + - field: user + type: user + score: 55 + - field: dest + type: system + score: 55 + threat_objects: [] +tags: + analytic_story: + - MacOS Post-Exploitation + asset_type: Endpoint + mitre_attack_id: + - T1070 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/osquery_log_removal/osquery.log + source: osquery + sourcetype: osquery:results diff --git a/detections/endpoint/macos_loginhook_persistence.yml b/detections/endpoint/macos_loginhook_persistence.yml new file mode 100644 index 0000000000..95af904982 --- /dev/null +++ b/detections/endpoint/macos_loginhook_persistence.yml @@ -0,0 +1,51 @@ +name: MacOS LoginHook Persistence +id: a04832e7-9d1d-49b1-a684-e31bcd775c77 +version: 1 +date: '2026-02-27' +author: Raven Tait, Splunk +status: production +type: TTP +description: Identifies attempts to configure a macOS LoginHook via the defaults utility. LoginHooks enable automatic execution of a script or program upon user login and have historically been abused for persistence. Creation or modification of this setting may indicate an attempt to establish startup execution outside standard LaunchAgent mechanisms. +data_source: + - osquery +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*defaults *" AND Processes.process = "*write*" AND Processes.process = "*loginwindow*" AND Processes.process = "*loginhook*" by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_loginhook_persistence_filter`' +how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://github.com/d1vious/TA-osquery) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +known_false_positives: This method is possibly still used by legacy enterprise management scripts. Update filter macro to remove false positives. +references: + - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ +drilldown_searches: + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Loginhook created on $dest$ by $user$ + risk_objects: + - field: user + type: user + score: 75 + - field: dest + type: system + score: 75 + threat_objects: [] +tags: + analytic_story: + - MacOS Post-Exploitation + asset_type: Endpoint + mitre_attack_id: + - T1037.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1037.002/osquery_logon_scripts/osquery.log + source: osquery + sourcetype: osquery:results diff --git a/detections/endpoint/macos_network_share_discovery.yml b/detections/endpoint/macos_network_share_discovery.yml new file mode 100644 index 0000000000..847b9aaca4 --- /dev/null +++ b/detections/endpoint/macos_network_share_discovery.yml @@ -0,0 +1,51 @@ +name: MacOS Network Share Discovery +id: a5f5fe52-8e50-4fb0-ad1b-780be6c0d857 +version: 1 +date: '2026-03-02' +author: Raven Tait, Splunk +status: production +type: Anomaly +description: Identifies execution of network share enumeration commands (smbutil, showmount) that can be leveraged by adversaries to discover accessible SMB and NFS resources, supporting internal reconnaissance and potential lateral movement. +data_source: + - osquery +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*showmount *" OR Processes.process = "*smbutil *" by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_network_share_discovery_filter`' +how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://github.com/d1vious/TA-osquery) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models. +known_false_positives: Administrators may utilize these tools occasionaly for troubleshooting. +references: + - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/ +drilldown_searches: + - name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Network share information enumerated on $dest$ by $user$ + risk_objects: + - field: user + type: user + score: 18 + - field: dest + type: system + score: 18 + threat_objects: [] +tags: + analytic_story: + - MacOS Post-Exploitation + asset_type: Endpoint + mitre_attack_id: + - T1135 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1135/osquery_share_discovery/osquery.log + source: osquery + sourcetype: osquery:results diff --git a/stories/macos_persistence_techniques.yml b/stories/macos_persistence_techniques.yml new file mode 100644 index 0000000000..595a4069fd --- /dev/null +++ b/stories/macos_persistence_techniques.yml @@ -0,0 +1,17 @@ +name: MacOS Persistence Techniques +id: 3fc4619d-4a13-45f8-95a2-51056e221a1c +version: 1 +status: production +date: '2026-02-26' +author: Raven Tait, Splunk +description: UPDATE_DESCRIPTION +narrative: UPDATE_NARRATIVE +references: [] +tags: + category: + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file diff --git a/stories/macos_post_exploitation.yml b/stories/macos_post_exploitation.yml new file mode 100644 index 0000000000..69950c88d0 --- /dev/null +++ b/stories/macos_post_exploitation.yml @@ -0,0 +1,17 @@ +name: MacOS Post-Exploitation +id: bae14f9c-929d-4e2b-8fe7-e4680e0edbbb +version: 1 +status: production +date: '2026-02-26' +author: Raven Tait, Splunk +description: This analytic story identifies popular MacOS post exploitation tools such as autoSUID, LinEnum, LinPEAS, Linux Exploit Suggesters, MimiPenguin. +narrative: These tools allow operators find possible exploits or paths for privilege escalation based on stored credentials, user permissions, kernel version and distro version. +references: [] +tags: + category: + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file diff --git a/stories/macos_privilege_escalation.yml b/stories/macos_privilege_escalation.yml new file mode 100644 index 0000000000..32f465a787 --- /dev/null +++ b/stories/macos_privilege_escalation.yml @@ -0,0 +1,17 @@ +name: MacOS Privilege Escalation +id: 67f1ebd1-7a3c-4e9b-bb74-9656425db3c4 +version: 1 +status: production +date: '2026-02-26' +author: Raven Tait, Splunk +description: UPDATE_DESCRIPTION +narrative: UPDATE_NARRATIVE +references: [] +tags: + category: + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection