splunk-security_content/detections/macos___re_opened_applications.yml

name: MacOS - Re-opened Applications
id: 40bb64f9-f619-4e3d-8732-328d40377c4b
version: 1
date: '2020-02-07'
description: This search looks for processes referencing the plist files that determine
  which applications are re-opened when a user reboots their machine.
how_to_implement: In order to properly run this search, Splunk needs to ingest process
  data from your osquery deployed agents with the [splunk.conf](https://github.com/splunk/TA-osquery/blob/master/config/splunk.conf)
  pack enabled. Also the [TA-OSquery](https://github.com/splunk/TA-osquery) must be
  deployed across your indexers and universal forwarders in order to have the data
  populate the Endpoint data model.
type: ESCU
references: []
author: Jamie Windley, Splunk
search: '| tstats `security_content_summariesonly` count values(Processes.process)
  as process values(Processes.parent_process) as parent_process min(_time) as firstTime
  max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process="*com.apple.loginwindow*"
  by Processes.user Processes.process_name Processes.parent_process_name Processes.dest
  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
  | `macos___re_opened_applications_filter`'
known_false_positives: At this stage, there are no known false positives. During testing,
  no process events refering the com.apple.loginwindow.plist files were observed during
  normal operation of re-opening applications on reboot. Therefore, it can be asumed
  that any occurences of this in the process events would be worth investigating.
  In the event that the legitimate modification by the system of these files is in
  fact logged to the process log, then the process_name of that process can be whitelisted.
tags:
  kill_chain_phases:
  - Installation
  - Command and Control
  cis20:
  - CIS 8
  nist:
  - DE.DP
  - DE.CM
  security_domain: threat
  asset_type: Endpoint