macos:osquery process_events
process_events
- Log source
- osquery (macOS)
- Host type
- macOS
- Tier, host type
- Recommended
- Techniques
- 25
- Rules depending on it
- none
Why this tier
By role
| Role | Tier | Basis |
|---|---|---|
| macOS endpoint | Recommended |
Techniques it helps detect
- T1001.001 Junk Data
- T1001.002 Steganography
- T1007 System Service Discovery
- T1010 Application Window Discovery
- T1011 Exfiltration Over Other Network Medium
- T1021 Remote Services
- T1021.004 SSH
- T1021.005 VNC
- T1025 Data from Removable Media
- T1027.003 Steganography
- T1027.006 HTML Smuggling
- T1041 Exfiltration Over C2 Channel
- T1046 Network Service Discovery
- T1048 Exfiltration Over Alternative Protocol
- T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
- T1049 System Network Connections Discovery
- T1052.001 Exfiltration over USB
- T1053.002 At
- T1056.002 GUI Input Capture
- T1059.005 Visual Basic
- T1059.006 Python
- T1059.007 JavaScript
- T1090.004 Domain Fronting
- T1102 Web Service
Rules that depend on it
No vendor rule names this event or source directly.