Elastic Defend high stable eql

Operating System Security Updates Disabled

Identifies changes to the SoftwareUpdate preferences using the built-in defaults command. Adversaries may abuse this in an attempt to disable security updates.

View Source

Detection Logic

process where event.type == "start" and
 process.name == "defaults" and
 process.args like~ "write" and process.args like~ "-bool" and
 process.command_line like~ "*com.apple.SoftwareUpdate*" and process.args like~ "CriticalUpdateInstall" and process.args like~ "NO"

Field Validations

Loading…

Comments (0)

Loading comments...