From fe9ba858d8e06ec00af0a9e7e6ce8df347ba8bcd Mon Sep 17 00:00:00 2001 From: litemars <44295342+litemars@users.noreply.github.com> Date: Tue, 26 May 2026 20:20:17 +0200 Subject: [PATCH] [Rule Tuning] Reducing FP and adding detection gap in rule Dumping Account Hashes via Built-In Commands (#6187) * fine_tuning_rule --------- Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com> Co-authored-by: eric-forte-elastic (cherry picked from commit 4d25d522eb0727513b0b9487c028e3c154973b2e) --- .../credential_access_dumping_hashes_bi_cmds.toml | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/rules/macos/credential_access_dumping_hashes_bi_cmds.toml b/rules/macos/credential_access_dumping_hashes_bi_cmds.toml index f3f850663..9e3c8e681 100644 --- a/rules/macos/credential_access_dumping_hashes_bi_cmds.toml +++ b/rules/macos/credential_access_dumping_hashes_bi_cmds.toml @@ -2,7 +2,7 @@ creation_date = "2021/01/25" integration = ["endpoint"] maturity = "production" -updated_date = "2026/03/24" +updated_date = "2026/05/26" [rule] author = ["Elastic"] @@ -60,8 +60,15 @@ timestamp_override = "event.ingested" type = "eql" query = ''' -process where host.os.type == "macos" and event.type in ("start", "process_started") and - process.name in ("defaults", "mkpassdb") and process.args like~ ("ShadowHashData", "-dump") +process where host.os.type == "macos" and event.type in ("start","process_started") and ( + (process.name == "defaults" and process.args like~ "ShadowHashData") or + (process.name == "mkpassdb" and process.args == "-dump") or + (process.name == "dscl" and process.args like~ "ShadowHashData") or + ( + process.name in ("plutil","cat","strings","xxd","head") and + process.args like "/var/db/dslocal/nodes/Default/users/*.plist" + ) +) ''' note = """## Triage and analysis