From 941fbebcdcbc60296c45ee018c5ad9cdcff4b82e Mon Sep 17 00:00:00 2001
From: Yugoslavskiy Daniil <yugoslavskiy@gmail.com>
Date: Tue, 20 Oct 2020 01:14:56 +0200
Subject: [PATCH] add macos_system_network_connections_discovery.yml, oscd
 initiative issue #1012, task number 14

---
 ...s_system_network_connections_discovery.yml | 26 +++++++++++++++++++
 1 file changed, 26 insertions(+)
 create mode 100644 rules/linux/macos_system_network_connections_discovery.yml

diff --git a/rules/linux/macos_system_network_connections_discovery.yml b/rules/linux/macos_system_network_connections_discovery.yml
new file mode 100644
index 000000000..32f1ad5bf
--- /dev/null
+++ b/rules/linux/macos_system_network_connections_discovery.yml
@@ -0,0 +1,26 @@
+title: System Network Connections Discovery
+id: 9a7a0393-2144-4626-9bf1-7c2f5a7321db
+status: experimental
+description: Detects usage of system utilities to discover system network connections
+author: Daniil Yugoslavskiy, oscd.community
+date: 2020/10/19
+references:
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1049/T1049.md
+logsource:
+  category: process_creation
+  product: macos
+detection:
+  selection:
+    ProcessName: 
+      - '/usr/bin/who'
+      - '/usr/bin/w'
+      - '/usr/bin/last'
+      - '/usr/sbin/lsof'
+      - '/usr/sbin/netstat'
+  condition: selection
+falsepositives:
+  - Legitimate activities
+level: low
+tags:
+  - attack.discovery
+  - attack.t1049
\ No newline at end of file