name: Suspicious PlistBuddy Usage via OSquery
id: 20ba6c32-c733-4a32-b64e-2688cf231399
version: 1
date: '2021-02-22'
author: Michael Haag, Splunk
type: batch
datamodel: []
description: 'The following analytic identifies the use of a native MacOS utility,
  PlistBuddy, creating or modifying a properly list (.plist) file. In the instance
  of Silver Sparrow, the following commands were executed:\

  - PlistBuddy -c "Add :Label string init_verx" ~/Library/Launchagents/init_verx.plist
  \

  - PlistBuddy -c "Add :RunAtLoad bool true" ~/Library/Launchagents/init_verx.plist
  \

  - PlistBuddy -c "Add :StartInterval integer 3600" ~/Library/Launchagents/init_verx.plist
  \

  - PlistBuddy -c "Add :ProgramArguments array" ~/Library/Launchagents/init_verx.plist
  \

  - PlistBuddy -c "Add :ProgramArguments:0 string /bin/sh" ~/Library/Launchagents/init_verx.plist
  \

  - PlistBuddy -c "Add :ProgramArguments:1 string -c" ~/Library/Launchagents/init_verx.plist
  \

  Upon triage, capture the property list file being written to disk and review for
  further indicators. Contain the endpoint and triage further.'
search: '`osquery_process` "columns.cmdline"="*LaunchAgents*" OR "columns.cmdline"="*RunAtLoad*"
  OR "columns.cmdline"="*true*" |  `suspicious_plistbuddy_usage_via_osquery_filter`'
how_to_implement: OSQuery must be installed and configured to pick up process events
  (info at https://osquery.io) as well as using the Splunk OSQuery Add-on https://splunkbase.splunk.com/app/4402.
  Modify the macro and validate fields are correct.
known_false_positives: Some legitimate applications may use PlistBuddy to create or
  modify property lists and possibly generate false positives. Review the property
  list being modified or created to confirm.
references:
- https://redcanary.com/blog/clipping-silver-sparrows-wings/
- https://marcosantadev.com/manage-plist-files-plistbuddy/
tags:
  analytic_story:
  - Silver Sparrow
  asset_type: Endpoint
  dataset: []
  kill_chain_phases:
  - Actions on Objectives
  mitre_attack_id:
  - T1543.001
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - columns.cmdline
  security_domain: endpoint
