pratinavchandra 9bfe3d6e62 Merge PR #4865 from @pratinavchandra - Add new rules related to "tmutil" potential abuse ...

new: Time Machine Backup Deletion Attempt Via Tmutil - MacOS
new: Time Machine Backup Disabled Via Tmutil - MacOS
new: New File Exclusion Added To Time Machine Via Tmutil - MacOS

---------

Co-authored-by: frack113 <62423083+frack113@users.noreply.github.com>
Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>

2024-05-31 12:52:55 +02:00

..

proc_creation_macos_applescript.yml

Update from review

2023-02-01 18:30:45 +01:00

proc_creation_macos_base64_decode.yml

Update Title (#3731)

2022-11-27 19:19:27 +01:00

proc_creation_macos_binary_padding.yml

Merge PR #4482 From @nasbench - Add New Automation Workflows

2023-10-18 11:53:44 +02:00

proc_creation_macos_change_file_time_attr.yml

feat: updates multiple mitre tech/sub-tech/tactics (#3913)

2023-01-12 17:04:38 +01:00

proc_creation_macos_clear_system_logs.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

proc_creation_macos_clipboard_data_via_osascript.yml

Merge PR #4611 from @nasbench - Promote Older Rules Status From experimental To test

2023-12-01 12:50:36 +01:00

proc_creation_macos_create_account.yml

Update proc_creation_macos_create_account.yml (#4052)

2023-02-20 14:13:06 +01:00

proc_creation_macos_create_hidden_account.yml

Order yaml field 4 (#3628)

2022-10-25 09:30:05 +02:00

proc_creation_macos_creds_from_keychain.yml

chore: add nextron authors tag

2023-02-01 11:14:59 +01:00

proc_creation_macos_csrutil_disable.yml

Merge PR #4640 from @jstnk9 - Add new rules related to System Integrity Protection (SIP) enumeration and tamper

2024-01-10 13:36:06 +01:00

proc_creation_macos_csrutil_status.yml

Merge PR #4640 from @jstnk9 - Add new rules related to System Integrity Protection (SIP) enumeration and tamper

2024-01-10 13:36:06 +01:00

proc_creation_macos_disable_security_tools.yml

Order yaml field 4 (#3628)

2022-10-25 09:30:05 +02:00

proc_creation_macos_dscl_add_user_to_admin_group.yml

Merge PR #4700 from @nasbench - Promote older rules status from experimental to test

2024-02-01 02:09:31 +01:00

proc_creation_macos_dseditgroup_add_to_admin_group.yml

Merge PR #4482 From @nasbench - Add New Automation Workflows

2023-10-18 11:53:44 +02:00

proc_creation_macos_dsenableroot_enable_root_account.yml

feat: update metadata & logic

2023-08-22 14:34:20 +02:00

proc_creation_macos_file_and_directory_discovery.yml

Title modified in several rules (#3728)

2022-11-25 15:34:38 +01:00

proc_creation_macos_find_cred_in_files.yml

Order yaml field 4 (#3628)

2022-10-25 09:30:05 +02:00

proc_creation_macos_gui_input_capture.yml

Promotion rules (#3821)

2022-12-27 12:29:10 +01:00

proc_creation_macos_installer_susp_child_process.yml

chore: promote older rules status from experimental to test (#4651)

2024-01-01 09:00:51 +01:00

proc_creation_macos_ioreg_discovery.yml

Merge PR #4645 from @slincoln-aiq - Update: System Information Discovery Using Ioreg

2024-01-10 14:00:01 +01:00

proc_creation_macos_jamf_susp_child.yml

Update rules/macos/process_creation/proc_creation_macos_jamf_susp_child.yml

2023-08-22 15:09:42 +02:00

proc_creation_macos_jamf_usage.yml

fix: wording

2023-08-22 14:56:25 +02:00

proc_creation_macos_jxa_in_memory_execution.yml

Merge PR #4611 from @nasbench - Promote Older Rules Status From experimental To test

2023-12-01 12:50:36 +01:00

proc_creation_macos_launchctl_execution.yml

Merge PR #4782 from @pratinavchandra - Add Launch Agent/Daemon Execution Via Launchctl

2024-05-13 16:55:33 +02:00

proc_creation_macos_local_account.yml

Update Title (#3733)

2022-11-28 06:43:17 +01:00

proc_creation_macos_local_groups.yml

Update Title (#3733)

2022-11-28 06:43:17 +01:00

proc_creation_macos_network_service_scanning.yml

Order yaml field 4 (#3628)

2022-10-25 09:30:05 +02:00

proc_creation_macos_network_sniffing.yml

Update Title (#3731)

2022-11-27 19:19:27 +01:00

proc_creation_macos_office_susp_child_processes.yml

Merge PR #4611 from @nasbench - Promote Older Rules Status From experimental To test

2023-12-01 12:50:36 +01:00

proc_creation_macos_osacompile_runonly_execution.yml

Merge PR #4611 from @nasbench - Promote Older Rules Status From experimental To test

2023-12-01 12:50:36 +01:00

proc_creation_macos_payload_decoded_and_decrypted.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

proc_creation_macos_persistence_via_plistbuddy.yml

chore: promote older rules status from experimental to test (#4651)

2024-01-01 09:00:51 +01:00

proc_creation_macos_remote_access_tools_teamviewer_incoming_connection.yml

Merge PR #4759 from @joshnck - Add new rules covering incoming TeamViewer connection activity

2024-03-15 21:41:29 +01:00

proc_creation_macos_remote_system_discovery.yml

Merge PR #4482 From @nasbench - Add New Automation Workflows

2023-10-18 11:53:44 +02:00

proc_creation_macos_schedule_task_job_cron.yml

Update Title (#3733)

2022-11-28 06:43:17 +01:00

proc_creation_macos_screencapture.yml

Order yaml field 4 (#3628)

2022-10-25 09:30:05 +02:00

proc_creation_macos_security_software_discovery.yml

Update Title (#3733)

2022-11-28 06:43:17 +01:00

proc_creation_macos_space_after_filename.yml

update logsource

2023-01-04 18:52:24 +01:00

proc_creation_macos_split_file_into_pieces.yml

Order yaml field 4 (#3628)

2022-10-25 09:30:05 +02:00

proc_creation_macos_susp_browser_child_process.yml

Merge PR #4700 from @nasbench - Promote older rules status from experimental to test

2024-02-01 02:09:31 +01:00

proc_creation_macos_susp_execution_macos_script_editor.yml

Merge PR #4533 from @nasbench - Promote experimental rules

2023-11-02 10:48:45 +01:00

proc_creation_macos_susp_find_execution.yml

Merge PR #4533 from @nasbench - Promote experimental rules

2023-11-02 10:48:45 +01:00

proc_creation_macos_susp_histfile_operations.yml

Order yaml field 4 (#3628)

2022-10-25 09:30:05 +02:00

proc_creation_macos_susp_in_memory_download_and_compile.yml

feat: update metadata

2023-08-22 18:22:05 +02:00

proc_creation_macos_susp_macos_firmware_activity.yml

old experimental rule promotion

2022-10-09 16:54:04 +02:00

proc_creation_macos_suspicious_applet_behaviour.yml

Merge PR #4700 from @nasbench - Promote older rules status from experimental to test

2024-02-01 02:09:31 +01:00

proc_creation_macos_swvers_discovery.yml

Merge PR #4615 from @jstnk9 - Update WMIC Discovery Rule + New System Discovery Rules For MacOS

2023-12-21 11:09:47 +01:00

proc_creation_macos_sysadminctl_add_user_to_admin_group.yml

Merge PR #4700 from @nasbench - Promote older rules status from experimental to test

2024-02-01 02:09:31 +01:00

proc_creation_macos_sysadminctl_enable_guest_account.yml

chore: promote older rules status from experimental to test (#4651)

2024-01-01 09:00:51 +01:00

proc_creation_macos_sysctl_discovery.yml

Merge PR #4785 from @pratinavchandra - add System Information Discovery Via Sysctl - MacOS

2024-05-27 18:05:09 +02:00

proc_creation_macos_system_network_connections_discovery.yml

feat: add new linux rules

2022-12-29 11:17:42 +01:00

proc_creation_macos_system_network_discovery.yml

fix: remove folder start

2022-12-29 11:32:37 +01:00

proc_creation_macos_system_profiler_discovery.yml

Merge PR #4649 from @slincoln-aiq - System Information Discovery Using System_Profiler

2024-01-10 14:29:49 +01:00

proc_creation_macos_system_shutdown_reboot.yml

Update Title (#3731)

2022-11-27 19:19:27 +01:00

proc_creation_macos_tail_base64_decode_from_image.yml

Merge PR #4615 from @jstnk9 - Update WMIC Discovery Rule + New System Discovery Rules For MacOS

2023-12-21 11:09:47 +01:00

proc_creation_macos_tmutil_delete_backup.yml

Merge PR #4865 from @pratinavchandra - Add new rules related to "tmutil" potential abuse

2024-05-31 12:52:55 +02:00

proc_creation_macos_tmutil_disable_backup.yml

Merge PR #4865 from @pratinavchandra - Add new rules related to "tmutil" potential abuse

2024-05-31 12:52:55 +02:00

proc_creation_macos_tmutil_exclude_file_from_backup.yml

Merge PR #4865 from @pratinavchandra - Add new rules related to "tmutil" potential abuse

2024-05-31 12:52:55 +02:00

proc_creation_macos_wizardupdate_malware_infection.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00

proc_creation_macos_xattr_gatekeeper_bypass.yml

Merge PR #4823 from @pratinavchandra - Update CLI flag for Gatekeeper Bypass via Xattr

2024-04-19 11:10:38 +02:00

proc_creation_macos_xcsset_malware_infection.yml

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17 14:35:26 +02:00