security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Rule Tuning] Modification of Environment Variable via Launchctl (#2119)

Browse Source 
* add exception for vmoptions
This commit is contained in:
Mika Ayenson
2022-07-22 16:03:46 -04:00
committed by GitHub
parent e8c39d19a7
commit cefb84ae15
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/macos/defense_evasion_modify_environment_launchctl.toml
+3 -2
View File
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2021/01/14"
maturity = "production"
updated_date = "2021/03/09"
updated_date = "2022/07/18"
[rule]
author = ["Elastic"]
@@ -39,7 +39,8 @@ event.category:process and event.type:start and
not process.parent.executable:("/Applications/NoMachine.app/Contents/Frameworks/bin/nxserver.bin" or
"/usr/local/bin/kr" or
"/Applications/NoMachine.app/Contents/Frameworks/bin/nxserver.bin" or
"/Applications/IntelliJ IDEA CE.app/Contents/jbr/Contents/Home/lib/jspawnhelper")
"/Applications/IntelliJ IDEA CE.app/Contents/jbr/Contents/Home/lib/jspawnhelper") and
not process.args : "*.vmoptions"
'''