security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MacOS FolderActionScripts Process List Update (#1723)

Browse Source 
* update and expand process list

* fix query

Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>
This commit is contained in:
Colson Wilhoit
2022-01-25 14:27:27 -06:00
committed by GitHub
parent cfd4d431dd
commit b564fa13fb
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/macos/persistence_folder_action_scripts_runtime.toml
+2 -2
View File
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2020/12/07"
maturity = "production"
updated_date = "2021/06/22"
updated_date = "2022/01/25"
[rule]
author = ["Elastic"]
@@ -25,7 +25,7 @@ type = "eql"
query = '''
sequence by host.id with maxspan=5s
[process where event.type in ("start", "process_started", "info") and process.name == "com.apple.foundation.UserScriptService"] by process.pid
[process where event.type in ("start", "process_started") and process.name in ("osascript", "sh")] by process.parent.pid
[process where event.type in ("start", "process_started") and process.name in ("osascript", "python", "tcl", "node", "perl", "ruby", "php", "bash", "csh", "zsh", "sh")] by process.parent.pid
'''