From b564fa13fb5080f4ae12366e83d03847fffa84f3 Mon Sep 17 00:00:00 2001 From: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com> Date: Tue, 25 Jan 2022 14:27:27 -0600 Subject: [PATCH] MacOS FolderActionScripts Process List Update (#1723) * update and expand process list * fix query Co-authored-by: Jonhnathan --- rules/macos/persistence_folder_action_scripts_runtime.toml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/rules/macos/persistence_folder_action_scripts_runtime.toml b/rules/macos/persistence_folder_action_scripts_runtime.toml index c639b9e6d..a6c19cdf5 100644 --- a/rules/macos/persistence_folder_action_scripts_runtime.toml +++ b/rules/macos/persistence_folder_action_scripts_runtime.toml @@ -1,7 +1,7 @@ [metadata] creation_date = "2020/12/07" maturity = "production" -updated_date = "2021/06/22" +updated_date = "2022/01/25" [rule] author = ["Elastic"] @@ -25,7 +25,7 @@ type = "eql" query = ''' sequence by host.id with maxspan=5s [process where event.type in ("start", "process_started", "info") and process.name == "com.apple.foundation.UserScriptService"] by process.pid - [process where event.type in ("start", "process_started") and process.name in ("osascript", "sh")] by process.parent.pid + [process where event.type in ("start", "process_started") and process.name in ("osascript", "python", "tcl", "node", "perl", "ruby", "php", "bash", "csh", "zsh", "sh")] by process.parent.pid '''