Elastic Defend high stable eql

Potential SIP Bypass via the ShoveService

Identifies the use of the Shove service to modify a SIP protected resource. A malicious application may be able to modify protected parts of the file system by spawning the shov process with the -X|x options (used to communicate with the system XPC service and removed by Apple in recent versions).

View Source

Detection Logic

process where event.action == "exec" and
 (process.name == "shove" or process.code_signature.signing_id like "com.apple.shove") and process.args == "-x"

Field Validations

Loading…

Comments (0)

Loading comments...