Elastic Defend high stable eql

Potential Privacy Control Bypass via Localhost Secure Copy

Identifies use of the Secure Copy Protocol (SCP) to copy files locally by abusing the auto addition of the Secure Shell Daemon (sshd) to the authorized application list for Full Disk Access. This may indicate attempts to bypass macOS privacy controls to access sensitive files.

View Source

Detection Logic

process where event.type == "start" and
 process.name == "scp" and
 process.args : "StrictHostKeyChecking=no" and
 process.command_line like~ ("*scp *localhost:/*", "*scp *127.0.0.?:/*") and not process.command_line like~ "*vagrant@*127.0.0.1*"

Field Validations

Loading…

Comments (0)

Loading comments...