macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_EXEC
ES_EVENT_TYPE_NOTIFY_EXEC
- Log source
- macOS Endpoint Security framework events
- Host type
- macOS
- Tier, host type
- Minimum
- Techniques
- 17
- Rules depending on it
- Sigma 70
Why this tier
By role
| Role | Tier | Basis |
|---|---|---|
| macOS endpoint | Minimum |
Techniques it helps detect
- T1027.008 Stripped Payloads
- T1027.009 Embedded Payloads
- T1027.010 Command Obfuscation
- T1027.014 Polymorphic Code
- T1027.016 Junk Code Insertion
- T1027.017 SVG Smuggling
- T1029 Scheduled Transfer
- T1033 System Owner/User Discovery
- T1036 Masquerading
- T1036.001 Invalid Code Signature
- T1036.002 Right-to-Left Override
- T1036.003 Rename Legitimate Utilities
- T1036.004 Masquerade Task or Service
- T1055 Process Injection
- T1104 Multi-Stage Channels
- T1105 Ingress Tool Transfer
- T1106 Native API
Rules that depend on it
Sigma 70
- Atomic MacOS Stealer - FileGrabber Activity by Jason Phang Vern - Onn, Robbin Ooi Zhen Heng (Gen Digital)
- Axios NPM Compromise Indicators - macOS by Swachchhanda Shrawan Poudel (Nextron Systems)
- Binary Padding - MacOS by Igor Fits, Mikhail Larin, oscd.community
- Clipboard Access Via OSAScript by Sohan G (D4rkCiph3r)
- Clipboard Data Collection Via Pbpaste by Daniel Cortez
- Creation Of A Local User Account by Alejandro Ortuno, oscd.community
- Credentials In Files by Igor Fits, Mikhail Larin, oscd.community
- Credentials from Password Stores - Keychain by Tim Ismilyaev, oscd.community, Florian Roth (Nextron Systems)
- Decode Base64 Encoded Text -MacOs by Daniil Yugoslavskiy, oscd.community
- Disable Security Tools by Daniil Yugoslavskiy, oscd.community
- Disk Image Creation Via Hdiutil - MacOS by Omar Khaled (@beacon_exe)
- Disk Image Mounting Via Hdiutil - MacOS by Omar Khaled (@beacon_exe)
- File Download Via Nscurl - MacOS by Daniel Cortez
- File Time Attribute Change by Igor Fits, Mikhail Larin, oscd.community
- File and Directory Discovery - MacOS by Daniil Yugoslavskiy, oscd.community
- GUI Input Capture - macOS by remotephone, oscd.community
- Gatekeeper Bypass via Xattr by Daniil Yugoslavskiy, oscd.community
- Guest Account Enabled Via Sysadminctl by Sohan G (D4rkCiph3r)
- Hidden Flag Set On File/Directory Via Chflags - MacOS by Omar Khaled (@beacon_exe)
- Hidden User Creation by Daniil Yugoslavskiy, oscd.community
- Indicator Removal on Host - Clear Mac System Logs by remotephone, oscd.community
- JAMF MDM Execution by Jay Pandit
- JAMF MDM Potential Suspicious Child Process by Nasreddine Bencherchali (Nextron Systems)
- JXA In-memory Execution Via OSAScript by Sohan G (D4rkCiph3r)
- Launch Agent/Daemon Execution Via Launchctl by Pratinav Chandra
- Local Groups Discovery - MacOs by Ömer Günal, Alejandro Ortuno, oscd.community
- Local System Accounts Discovery - MacOs by Alejandro Ortuno, oscd.community
- MacOS Network Service Scanning by Alejandro Ortuno, oscd.community
- MacOS Scripting Interpreter AppleScript by Alejandro Ortuno, oscd.community
- Macos Remote System Discovery by Alejandro Ortuno, oscd.community
- Network Sniffing - MacOs by Alejandro Ortuno, oscd.community
- New File Exclusion Added To Time Machine Via Tmutil - MacOS by Pratinav Chandra
- OSACompile Run-Only Execution by Sohan G (D4rkCiph3r)
- Osacompile Execution By Potentially Suspicious Applet/Osascript by Sohan G (D4rkCiph3r), Red Canary (Idea)
- Payload Decoded and Decrypted via Built-in Utilities by Tim Rauch (rule), Elastic (idea)
- Potential Base64 Decoded From Images by Joseliyo Sanchez, @Joseliyo_Jstnk
- Potential Discovery Activity Using Find - MacOS by Nasreddine Bencherchali (Nextron Systems)
- Potential In-Memory Download And Compile Of Payloads by Sohan G (D4rkCiph3r), Red Canary (idea)
- Potential Persistence Via PlistBuddy by Sohan G (D4rkCiph3r)
- Potential WizardUpdate Malware Infection by Tim Rauch (rule), Elastic (idea)
- Potential XCSSET Malware Infection by Tim Rauch (rule), Elastic (idea)
- Remote Access Tool - Potential MeshAgent Execution - MacOS by Norbert Jaśniewicz (AlphaSOC)
- Remote Access Tool - Renamed MeshAgent Execution - MacOS by Norbert Jaśniewicz (AlphaSOC)
- Remote Access Tool - Team Viewer Session Started On MacOS Host by Josh Nickels, Qi Nan
- Root Account Enable Via Dsenableroot by Sohan G (D4rkCiph3r)
- Scheduled Cron Task/Job - MacOs by Alejandro Ortuno, oscd.community
- Screen Capture - macOS by remotephone, oscd.community
- Security Software Discovery - MacOs by Daniil Yugoslavskiy, oscd.community
- Space After Filename - macOS by remotephone
- Split A File Into Pieces by Igor Fits, Mikhail Larin, oscd.community
- Suspicious Browser Child Process - MacOS by Sohan G (D4rkCiph3r)
- Suspicious Execution via macOS Script Editor by Tim Rauch (rule), Elastic (idea)
- Suspicious History File Operations by Mikhail Larin, oscd.community
- Suspicious Installer Package Child Process by Sohan G (D4rkCiph3r)
- Suspicious MacOS Firmware Activity by Austin Songer @austinsonger
- Suspicious Microsoft Office Child Process - MacOS by Sohan G (D4rkCiph3r)
- System Information Discovery Using Ioreg by Joseliyo Sanchez, @Joseliyo_Jstnk
- System Information Discovery Using System_Profiler by Stephen Lincoln `@slincoln_aiq` (AttackIQ)
- System Information Discovery Using sw_vers by Joseliyo Sanchez, @Joseliyo_Jstnk
- System Information Discovery Via Sysctl - MacOS by Pratinav Chandra
- System Integrity Protection (SIP) Disabled by Joseliyo Sanchez, @Joseliyo_Jstnk
- System Integrity Protection (SIP) Enumeration by Joseliyo Sanchez, @Joseliyo_Jstnk
- System Network Connections Discovery - MacOs by Daniil Yugoslavskiy, oscd.community
- System Network Discovery - macOS by remotephone, oscd.community
- System Shutdown/Reboot - MacOs by Igor Fits, Mikhail Larin, oscd.community
- Time Machine Backup Deletion Attempt Via Tmutil - MacOS by Pratinav Chandra
- Time Machine Backup Disabled Via Tmutil - MacOS by Pratinav Chandra
- User Added To Admin Group Via Dscl by Sohan G (D4rkCiph3r)
- User Added To Admin Group Via DseditGroup by Sohan G (D4rkCiph3r)
- User Added To Admin Group Via Sysadminctl by Sohan G (D4rkCiph3r)