security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Rule Tuning] Potential Persistence via Login Hook (#2177)

Browse Source 
* Exclude FPs for iMazing Profile Editor and backupd
This commit is contained in:
Mika Ayenson
2022-08-05 14:25:31 -04:00
committed by GitHub
parent 058f11f650
commit 4f55e9b05f
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/macos/persistence_loginwindow_plist_modification.toml
+3 -2
View File
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2021/01/21"
maturity = "production"
updated_date = "2021/05/10"
updated_date = "2022/07/26"
[rule]
author = ["Elastic"]
@@ -28,7 +28,8 @@ type = "query"
query = '''
event.category:"file" and not event.type:"deletion" and
file.name:"com.apple.loginwindow.plist" and
process.name:(* and not (systemmigrationd or DesktopServicesHelper or diskmanagementd or rsync or launchd or cfprefsd or xpcproxy or ManagedClient or MCXCompositor))
process.name:(* and not (systemmigrationd or DesktopServicesHelper or diskmanagementd or rsync or launchd or cfprefsd or xpcproxy or ManagedClient or MCXCompositor or backupd or "iMazing Profile Editor"
))
'''