Elastic Defend high stable eql

MacOS Hidden File Mounted

Detects when a hidden file gets mounted, which has been observed being leveraged to exploit vulnerabilities that allow for mounting over sensitive parts of the filesystem, thereby bypassing certain macOS security controls such as TCC and SIP.

View Source

Detection Logic

file where event.action == "mount" and file.path like "/private/tmp/.*" and not file.path like "/private/tmp/.easeus_rdisk"

Field Validations

Loading…

Comments (0)

Loading comments...