security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Rule Tuning] Persistence via Folder Action Script (#2174)

Browse Source 
* Exclude FPs for iterm
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
This commit is contained in:
Mika Ayenson
2022-08-05 14:36:05 -04:00
committed by GitHub
parent 4f55e9b05f
commit d1bc53e295
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/macos/persistence_folder_action_scripts_runtime.toml
+4 -2
View File
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2020/12/07"
maturity = "production"
updated_date = "2022/02/28"
updated_date = "2022/07/26"
[rule]
author = ["Elastic"]
@@ -25,7 +25,9 @@ type = "eql"
query = '''
sequence by host.id with maxspan=5s
[process where event.type in ("start", "process_started", "info") and process.name == "com.apple.foundation.UserScriptService"] by process.pid
[process where event.type in ("start", "process_started") and process.name in ("osascript", "python", "tcl", "node", "perl", "ruby", "php", "bash", "csh", "zsh", "sh")] by process.parent.pid
[process where event.type in ("start", "process_started") and process.name in ("osascript", "python", "tcl", "node", "perl", "ruby", "php", "bash", "csh", "zsh", "sh") and
not process.args : "/Users/*/Library/Application Support/iTerm2/Scripts/AutoLaunch/*.scpt"
] by process.parent.pid
'''