Elastic Defend high stable eql

Modification of Safari Settings via Defaults Command

Identifies changes to the Safari configuration using the built-in defaults command. Adversaries may attempt to enable or disable certain Safari settings, such as enabling JavaScript from Apple Events to ease the user's browser's hijacking.

View Source

Detection Logic

process where event.type == "start" and
  process.name == "defaults" and process.args like~ "write" and
  process.command_line like~ "*com.apple.Safari*" and process.command_line like~ ("*IncludeDevelopMenu*", "*JavaScript*")

Field Validations

Loading…

Comments (0)

Loading comments...