Anvilogic medium experimental spl

Swift Script Execution - MacOS [splunk-edr]

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands. This use case detects Swift scripts executed from the command line.

View Source

Detection Logic

`get_endpoint_data` `get_endpoint_data_edr` TERM(swift)
| regex process="(?i)swift\s+"
| table _time, host, user process, process_*, parent_process*
| bin span=1s
| stats values(*) as * by _time, host
| where match(parent_process_name, "(?i)zsh
| bash
| sh
| tcsh
| csh
| ksh")

Field Validations

Loading…

Comments (0)

Loading comments...