macos:osquery socket_events
socket_events
- Log source
- osquery (macOS)
- Host type
- macOS
- Tier, host type
- Recommended
- Techniques
- 10
- Rules depending on it
- none
Why this tier
By role
| Role | Tier | Basis |
|---|---|---|
| macOS endpoint | Recommended |
Techniques it helps detect
- T1041 Exfiltration Over C2 Channel
- T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol
- T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
- T1071 Application Layer Protocol
- T1071.001 Web Protocols
- T1071.002 File Transfer Protocols
- T1071.003 Mail Protocols
- T1071.005 Publish/Subscribe Protocols
- T1102 Web Service
Rules that depend on it
No vendor rule names this event or source directly.