From 8c84a7826d8df1367caa746fd15ac19f23fcee56 Mon Sep 17 00:00:00 2001
From: P4T12ICK <pbareiss@splunk.com>
Date: Tue, 29 Mar 2022 15:39:30 +0200
Subject: [PATCH 1/3] plutil mac os detection

---
 detections/endpoint/macos_plutil.yml | 68 ++++++++++++++++++++++++++++
 tests/endpoint/macos_plutil.test.yml | 12 +++++
 2 files changed, 80 insertions(+)
 create mode 100644 detections/endpoint/macos_plutil.yml
 create mode 100644 tests/endpoint/macos_plutil.test.yml

diff --git a/detections/endpoint/macos_plutil.yml b/detections/endpoint/macos_plutil.yml
new file mode 100644
index 0000000000..6efafee688
--- /dev/null
+++ b/detections/endpoint/macos_plutil.yml
@@ -0,0 +1,68 @@
+name: MacOS plutil
+id: c11f2b57-92c1-4cd2-b46c-064eafb833ac
+version: 1
+date: '2022-03-29'
+author: Patrick Bareiss, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: Detect usage of plutil to modify plist files. Adversaries can modiy plist files to executed binaries or add command line
+  arguments. Plist files in auto-run locations are executed upon user logon or system startup.
+search: '`osquery` name=es_process_events columns.path=/usr/bin/plutil
+  | rename columns.* as *
+  | stats count  min(_time) as firstTime max(_time) as lastTime by username host cmdline pid path parent signing_id
+  | rename username as User, cmdline as process, path as process_path
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+  | `macos_plutil_filter`'
+how_to_implement: This detection uses osquery and endpoint security on MacOS.
+  Follow the link in references, which describes how to setup process auditing in MacOS
+  with endpoint security and osquery.
+known_false_positives: Administrators using plutil to change plist files.
+references:
+- https://osquery.readthedocs.io/en/stable/deployment/process-auditing/
+tags:
+  analytic_story:
+  - Living Off The Land
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.011/atomic_red_team/osquery.log
+  impact: 50
+  kill_chain_phases:
+  - Actions on Objectives
+  message: plutil are executed on $host$ from $user$
+  mitre_attack_id:
+  - T1547.011
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: process
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - columns.cmdline
+  - columns.pid
+  - columns.parent
+  - columns.path
+  - columns.signing_id
+  - columns.username
+  - host
+  risk_score: 25
+  security_domain: endpoint
diff --git a/tests/endpoint/macos_plutil.test.yml b/tests/endpoint/macos_plutil.test.yml
new file mode 100644
index 0000000000..38ca7fab1f
--- /dev/null
+++ b/tests/endpoint/macos_plutil.test.yml
@@ -0,0 +1,12 @@
+name: MacOS plutil Unit Test
+tests:
+- name: MacOS plutil
+  file: endpoint/macos_plutil.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: osquery.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.011/atomic_red_team/osquery.log
+    source: osquery
+    sourcetype: osquery:results
\ No newline at end of file

From cd9f4018ab7b7cb7a055397402a84d1ff25cc7a8 Mon Sep 17 00:00:00 2001
From: P4T12ICK <pbareiss@splunk.com>
Date: Fri, 1 Apr 2022 14:07:08 +0200
Subject: [PATCH 2/3] small change

---
 README.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/README.md b/README.md
index 911a9278f7..58039bb5e8 100644
--- a/README.md
+++ b/README.md
@@ -129,3 +129,4 @@ distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
+

From 4049334910ea3d52a917ca35aed66d11c80ed966 Mon Sep 17 00:00:00 2001
From: P4T12ICK <pbareiss@splunk.com>
Date: Mon, 4 Apr 2022 10:43:01 +0200
Subject: [PATCH 3/3] small change

---
 detections/endpoint/macos_plutil.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/detections/endpoint/macos_plutil.yml b/detections/endpoint/macos_plutil.yml
index 6efafee688..3401678938 100644
--- a/detections/endpoint/macos_plutil.yml
+++ b/detections/endpoint/macos_plutil.yml
@@ -66,3 +66,4 @@ tags:
   - host
   risk_score: 25
   security_domain: endpoint
+