name: MacOS - Re-opened Applications
id: 40bb64f9-f619-4e3d-8732-328d40377c4b
version: 1
date: '2020-02-07'
author: Jamie Windley, Splunk
type: batch
datamodel:
- Endpoint
description: This search looks for processes referencing the plist files that determine
  which applications are re-opened when a user reboots their machine.
search: '| tstats `security_content_summariesonly` count values(Processes.process)
  as process values(Processes.parent_process) as parent_process min(_time) as firstTime
  max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process="*com.apple.loginwindow*"
  by Processes.user Processes.process_name Processes.parent_process_name Processes.dest
  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
  | `macos___re_opened_applications_filter`'
how_to_implement: In order to properly run this search, Splunk needs to ingest process
  data from your osquery deployed agents with the [splunk.conf](https://github.com/splunk/TA-osquery/blob/master/config/splunk.conf)
  pack enabled. Also the [TA-OSquery](https://github.com/splunk/TA-osquery) must be
  deployed across your indexers and universal forwarders in order to have the data
  populate the Endpoint data model.
known_false_positives: At this stage, there are no known false positives. During testing,
  no process events refering the com.apple.loginwindow.plist files were observed during
  normal operation of re-opening applications on reboot. Therefore, it can be asumed
  that any occurences of this in the process events would be worth investigating.
  In the event that the legitimate modification by the system of these files is in
  fact logged to the process log, then the process_name of that process can be added
  to an allow list.
references: []
tags:
  asset_type: Endpoint
  cis20:
  - CIS 8
  kill_chain_phases:
  - Installation
  - Command and Control
  nist:
  - DE.DP
  - DE.CM
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - Processes.process
  - Processes.parent_process
  - Processes.user
  - Processes.process_name
  - Processes.parent_process_name
  - Processes.dest
  security_domain: threat
