mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Eric McGinnis
92 lines
4.1 KiB
YAML
92 lines
4.1 KiB
YAML
name: MacOS Data Chunking
|
|
id: 7f1c8bed-9bd4-40b0-a1df-c262cbade0fc
|
|
version: 3
|
|
creation_date: '2026-04-14'
|
|
modification_date: '2026-05-13'
|
|
author: Raven Tait, Splunk
|
|
status: production
|
|
type: Anomaly
|
|
description: |-
|
|
The following analytic detects suspicious data chunking activities that involve the use of split or dd, potentially indicating an attempt to evade detection by breaking large files into smaller parts.
|
|
Attackers may use this technique to bypass size-based security controls, facilitating the covert exfiltration of sensitive data.
|
|
By monitoring for unusual or unauthorized use of these commands, this analytic helps identify potential data exfiltration attempts, allowing security teams to intervene and prevent the unauthorized transfer of critical information from the network.
|
|
data_source:
|
|
- Osquery Results
|
|
search: |-
|
|
| tstats `security_content_summariesonly`
|
|
count min(_time) as firstTime
|
|
max(_time) as lastTime
|
|
|
|
from datamodel=Endpoint.Processes where
|
|
|
|
(
|
|
Processes.process = "dd *"
|
|
Processes.process = "* if=*"
|
|
)
|
|
OR
|
|
(
|
|
Processes.process = "*split *"
|
|
Processes.process="* -b *"
|
|
)
|
|
|
|
by Processes.dest Processes.original_file_name Processes.parent_process_id
|
|
Processes.process Processes.process_exec Processes.process_guid
|
|
Processes.process_hash Processes.process_id
|
|
Processes.process_current_directory Processes.process_name
|
|
Processes.process_path Processes.user
|
|
Processes.user_id Processes.vendor_product
|
|
|
|
| `drop_dm_object_name(Processes)`
|
|
| `security_content_ctime(firstTime)`
|
|
| `security_content_ctime(lastTime)`
|
|
| `macos_data_chunking_filter`
|
|
how_to_implement: |-
|
|
This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
|
|
Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
|
|
known_false_positives: |-
|
|
Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
|
|
references:
|
|
- https://osquery.readthedocs.io/en/stable/deployment/process-auditing/
|
|
- https://ss64.com/mac/dd.html
|
|
- https://ss64.com/mac/split.html
|
|
drilldown_searches:
|
|
- name: View the detection results for - "$user$" and "$dest$"
|
|
search: '%original_detection_search% | search user = "$user$" dest = "$dest$"'
|
|
earliest_offset: $info_min_time$
|
|
latest_offset: $info_max_time$
|
|
- name: View risk events for the last 7 days for - "$user$" and "$dest$"
|
|
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
|
|
earliest_offset: 7d
|
|
latest_offset: "0"
|
|
intermediate_findings:
|
|
entities:
|
|
- field: user
|
|
type: user
|
|
score: 20
|
|
message: A file was split on $dest$ by $user$ via $process$
|
|
- field: dest
|
|
type: system
|
|
score: 20
|
|
message: A file was split on $dest$ by $user$ via $process$
|
|
threat_objects:
|
|
- field: process
|
|
type: process
|
|
analytic_story:
|
|
- MacOS Post-Exploitation
|
|
asset_type: Endpoint
|
|
mitre_attack_id:
|
|
- T1030
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
category: endpoint
|
|
security_domain: endpoint
|
|
tests:
|
|
- name: True Positive Test
|
|
attack_data:
|
|
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1030/osquery_data_chunking/osquery.log
|
|
source: osquery
|
|
sourcetype: osquery:results
|
|
test_type: unit
|