Elastic Defend high stable eql

Suspicious DMG File Creation in Tmp Directory

Detects the creation of a DMG file in the temp directory. The creation of a DMG file like this has been observed being used to exploit vulnerabilities that allow for mounting over sensitive parts of the filesystem, thereby bypassing certain macOS security controls such as TCC and SIP. This activity is not normal or common and should be considered suspicious.

View Source

Detection Logic

file where event.action in ("modification", "rename") and process.name == "diskimages-helper" and
    file.extension == "dmg" and file.path like ("/private/tmp/*", "/tmp/*") and not
    file.path like~ ("/private/tmp/munki-*/*.dmg", "/private/tmp/Ventura.dmg", "/private/tmp/Sonoma.dmg", "/private/tmp/com.ninxsoft.mist/*")

Field Validations

Loading…

Comments (0)

Loading comments...