macos:osquery file_events
file_events
- Log source
- osquery (macOS)
- Host type
- macOS
- Tier, host type
- Recommended
- Techniques
- 12
- Rules depending on it
- none
Why this tier
By role
| Role | Tier | Basis |
|---|---|---|
| macOS endpoint | Recommended |
Techniques it helps detect
- T1018 Remote System Discovery
- T1027 Obfuscated Files or Information
- T1027.003 Steganography
- T1027.004 Compile After Delivery
- T1027.005 Indicator Removal from Tools
- T1048 Exfiltration Over Alternative Protocol
- T1052 Exfiltration Over Physical Medium
- T1070.006 Timestomp
- T1070.007 Clear Network Connection History and Configurations
- T1070.008 Clear Mailbox Data
- T1070.009 Clear Persistence
- T1070.010 Relocate Malware
Rules that depend on it
No vendor rule names this event or source directly.