security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #1246 from oscd-initiative/oscd_art_macos_task_14_T1049

Browse Source 
[OSCD] ART sync, test T1049: System Network Connections Discovery (macOS)
This commit is contained in:
Thomas Patzke
2020-12-30 22:57:29 +01:00
committed by GitHub
parent fb9698345b 941fbebcdc
commit aa5396cb9f
1 changed files with 26 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/linux/macos_system_network_connections_discovery.yml
+26
View File
@@ -0,0 +1,26 @@
title: System Network Connections Discovery
id: 9a7a0393-2144-4626-9bf1-7c2f5a7321db
status: experimental
description: Detects usage of system utilities to discover system network connections
author: Daniil Yugoslavskiy, oscd.community
date: 2020/10/19
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1049/T1049.md
logsource:
category: process_creation
product: macos
detection:
selection:
ProcessName:
- '/usr/bin/who'
- '/usr/bin/w'
- '/usr/bin/last'
- '/usr/sbin/lsof'
- '/usr/sbin/netstat'
condition: selection
falsepositives:
- Legitimate activities
level: low
tags:
- attack.discovery
- attack.t1049