Elastic medium stable eql

Finder Sync Plugin Registered and Enabled

Finder Sync plugins enable users to extend Finder’s functionality by modifying the user interface. Adversaries may abuse this feature by adding a rogue Finder Plugin to repeatedly execute malicious payloads for persistence.

View Source

Detection Logic

process where host.os.type == "macos" and event.type in ("start", "process_started") and process.name == "pluginkit" and
  process.args == "-e" and process.args like~ "use" and process.args == "-i" and
  (process.parent.name like~ ("python*", "node", "osascript", "bash", "sh", "zsh") or (process.parent.code_signature.exists == false or process.parent.code_signature.trusted == false))

False Positives

⚠ Trusted Finder Sync Plugins

Field Validations

Loading…

Comments (0)

Loading comments...