admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update macos_amos_stealer___virtual_machine_check_activity.yml

Browse Source
This commit is contained in:
Nasreddine Bencherchali
2025-04-25 13:24:48 +02:00
parent 4cb367256c
commit 677c3b0df4
1 changed files with 4 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/macos_amos_stealer___virtual_machine_check_activity.yml
+4 -7
View File
@@ -11,12 +11,8 @@ description: |
data_source:
- osquery
search: |
'`osquery_macro` name=es_process_events
columns.cmdline="*osascript*"
columns.cmdline="* -e *"
columns.cmdline="*set*"
columns.cmdline="*system_profiler*"
columns.cmdline IN ("*VMware*", "*QEMU*")
`osquery_macro` name=es_process_events
columns.cmdline="*osascript*" AND columns.cmdline="* -e *" AND columns.cmdline="*set*" AND columns.cmdline="*system_profiler*" AND columns.cmdline IN ("*VMware*", "*QEMU*")
| rename columns.* as *
| stats min(_time) as firstTime max(_time) as lastTime
values(cmdline) as cmdline,
@@ -28,11 +24,12 @@ search: |
| rename
username as user,
cmdline as process,
parent as parent_process,
path as process_path,
host as dest
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `macos_amos_stealer___virtual_machine_check_activity_filter`'
| `macos_amos_stealer___virtual_machine_check_activity_filter`
how_to_implement: |
This detection leverages osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
known_false_positives: None identified.