From be884a1cf34654f59430e685cd6d2e25172f34b2 Mon Sep 17 00:00:00 2001 From: Mika Ayenson Date: Thu, 22 Dec 2022 10:27:10 -0500 Subject: [PATCH] [Rule Tuning] Screensaver Plist File Modified by Unexpected Process (#2413) --- ...e_screensaver_plist_file_modification.toml | 28 +++++++++++++++---- 1 file changed, 22 insertions(+), 6 deletions(-) diff --git a/rules/macos/persistence_screensaver_plist_file_modification.toml b/rules/macos/persistence_screensaver_plist_file_modification.toml index edcbaabc1..fd5a890d6 100644 --- a/rules/macos/persistence_screensaver_plist_file_modification.toml +++ b/rules/macos/persistence_screensaver_plist_file_modification.toml @@ -3,7 +3,7 @@ creation_date = "2021/10/05" maturity = "production" min_stack_comments = "New fields added: required_fields, related_integrations, setup" min_stack_version = "8.3.0" -updated_date = "2022/08/24" +updated_date = "2022/12/05" [rule] author = ["Elastic"] @@ -41,11 +41,27 @@ type = "eql" query = ''' file where event.type != "deletion" and file.name: "com.apple.screensaver.*.plist" and - file.path : ( - "/Users/*/Library/Preferences/ByHost/*", - "/Library/Managed Preferences/*", - "/System/Library/Preferences/*" - ) and + file.path : ( + "/Users/*/Library/Preferences/ByHost/*", + "/Library/Managed Preferences/*", + "/System/Library/Preferences/*" + ) and + ( + process.code_signature.trusted == false or + process.code_signature.exists == false or + + /* common script interpreters and abused native macOS bins */ + process.name : ( + "curl", + "mktemp", + "tail", + "funzip", + "python*", + "osascript", + "perl" + ) + ) and + /* Filter OS processes modifying screensaver plist files */ not process.executable : ( "/usr/sbin/cfprefsd",