Elastic high stable eql

Dumping Account Hashes via Built-In Commands

Identifies the execution of macOS built-in commands used to dump user account hashes. Adversaries may attempt to dump credentials to obtain account login information in the form of a hash. These hashes can be cracked or leveraged for lateral movement.

View Source

Detection Logic

process where host.os.type == "macos" and event.type in ("start","process_started") and (
  (process.name == "defaults" and process.args like~ "ShadowHashData") or
  (process.name == "mkpassdb" and process.args == "-dump") or
  (process.name == "dscl" and process.args like~ "ShadowHashData") or
  (
    process.name in ("plutil","cat","strings","xxd","head") and
    process.args like "/var/db/dslocal/nodes/Default/users/*.plist"
  )
)

Field Validations

Loading…

Comments (0)

Loading comments...