Elastic high stable kql

SSFileCopyReceiver Writing to Common Persistence Locations

Identifies the macOS Screen Sharing file copy helper SSFileCopyReceiver creating or modifying files in common persistence locations, including system-wide and per-user LaunchDaemons/LaunchAgents, shell profiles, SSH authorized_keys, cron tabs, and hidden paths under root's home directory. SSFileCopyReceiver performs file writes with root authority on behalf of a remote viewer.Pre-authentication exploitation of the Screen Sharing service (CVE-2026-65400) abuses this write primitive to establish persistence; observed in-the-wild activity dropped LaunchDaemons and modified shell startup files to run a cryptocurrency miner as root.

View Source

Detection Logic

from logs-endpoint.events.file-* METADATA _id, _index, _version
| WHERE host.os.type == "macos"
    
AND event.type != "deletion"
    
AND process.name == "SSFileCopyReceiver"
    
AND (
        file.path LIKE "/Library/LaunchDaemons/*.plist"
        
OR file.path LIKE "/Library/LaunchAgents/*.plist"
        
OR file.path LIKE "/Users/*/Library/LaunchAgents/*.plist"
        
OR file.path LIKE "/private/var/*/Library/LaunchAgents/*.plist"
        
OR file.name IN (".zshenv", ".zshrc", ".zprofile", ".zlogin", ".bashrc", ".bash_profile", ".bash_login", ".profile", "config.fish", "environment.plist")
        
OR file.path LIKE "/Users/*/.ssh/authorized_keys"
        
OR file.path LIKE "/private/var/root/.ssh/authorized_keys"
        
OR file.path LIKE "/private/etc/ssh/sshd_config*"
        
OR file.path LIKE "/private/var/at/tabs/*"
        
OR file.path LIKE "/var/at/tabs/*"
        
OR file.path LIKE "/private/var/root/.*/*"
        
OR file.path LIKE "/var/root/.*/*"
        
OR file.path LIKE "/private/var/root/.*"
        
OR file.path LIKE "/var/root/.*"
    )
| KEEP _id, _index, _version, 
    @timestamp, host.name, host.id, user.id, user.name, process.name, 
    event.action, event.type, file.path, file.name, data_stream.namespace

Field Validations

Loading…

Comments (0)

Loading comments...