Elastic low stable eql

Potential Persistence via Periodic Tasks

Identifies the creation or modification of the default configuration for periodic tasks. Adversaries may abuse periodic tasks to execute malicious code or maintain persistence.

View Source

Detection Logic

file where host.os.type == "macos" and event.action == "modification" and
 file.path like ("/private/etc/periodic/*", "/private/etc/defaults/periodic.conf", "/private/etc/periodic.conf")

Field Validations

Loading…

Comments (0)

Loading comments...