From 9ba9575db7312b52370fa200c77216cdf4ecdca8 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Tue, 5 Apr 2022 19:00:05 +0200 Subject: [PATCH] improved MacOS detection --- detections/endpoint/macos_lolbin.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/macos_lolbin.yml b/detections/endpoint/macos_lolbin.yml index 089dff4447..09d433ef39 100644 --- a/detections/endpoint/macos_lolbin.yml +++ b/detections/endpoint/macos_lolbin.yml @@ -13,6 +13,7 @@ search: '`osquery` name=es_process_events columns.cmdline IN ("find*", "crontab* | stats min(_time) as firstTime max(_time) as lastTime values(cmdline) as cmdline, values(pid) as pid, values(parent) as parent, values(path) as path, values(signing_id) as signing_id, dc(path) as dc_path by username host | rename username as User, cmdline as process, path as process_path + | where dc_path > 3 | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `macos_lolbin_filter`' how_to_implement: This detection uses osquery and endpoint security on MacOS.