security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Rule Tuning] Remove File Quarantine Attribute (#2129)

Browse Source
This commit is contained in:
Colson Wilhoit
2022-07-22 15:25:12 -05:00
committed by GitHub
parent 1e28385ea4
commit d6527afd51
1 changed files with 5 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/macos/defense_evasion_attempt_del_quarantine_attrib.toml
+5 -13
View File
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2020/08/14"
maturity = "production"
updated_date = "2022/07/18"
updated_date = "2022/07/20"
[rule]
author = ["Elastic"]
@@ -32,20 +32,12 @@ type = "eql"
query = '''
process where event.type in ("start", "process_started") and
process.args : "xattr" and
process.name : "xattr" and
(
(process.args : "com.apple.quarantine" and process.args : ("-d", "-w")) or
(process.args : "-c" and process.command_line :
(
"/bin/bash -c xattr -c *",
"/bin/zsh -c xattr -c *",
"/bin/sh -c xattr -c *"
)
)
) and not process.args : (
"/Applications/Google Chrome.app",
"/Applications/Microsoft Edge.app"
)
(process.args : "-c") or
(process.command_line : ("/bin/bash -c xattr -c *", "/bin/zsh -c xattr -c *", "/bin/sh -c xattr -c *"))
) and not process.args_count > 12
'''