Elastic medium stable eql

Emond Rules Creation or Modification

Identifies the creation or modification of the Event Monitor Daemon (emond) rules. Adversaries may abuse this service by writing a rule to execute commands when a defined event occurs, such as system start up or user authentication.

View Source

Detection Logic

file where host.os.type == "macos" and event.action == "modification" and
 file.path like ("/private/etc/emond.d/rules/*.plist", "/etc/emond.d/rules/*.plist", "/private/var/db/emondClients/*")

Field Validations

Loading…

Comments (0)

Loading comments...