Elastic medium stable eql

Persistence via Docker Shortcut Modification

An adversary can establish persistence by modifying an existing macOS dock property list in order to execute a malicious application instead of the intended one when invoked.

View Source

Detection Logic

file where host.os.type == "macos" and event.action == "modification" and
 file.path like "/Users/*/Library/Preferences/com.apple.dock.plist" and
 ((process.name like~ ("osascript", "python*", "sh", "bash", "zsh", "node") or Effective_process.name like~ ("osascript", "python*", "sh", "bash", "zsh", "node")) or
  (process.code_signature.exists == false or process.code_signature.trusted == false))

Field Validations

Loading…

Comments (0)

Loading comments...