Elastic high stable kql
SSFileCopyReceiver Writing to Common Persistence Locations
Identifies the macOS Screen Sharing file copy helper SSFileCopyReceiver creating or modifying files in common persistence locations, including system-wide and per-user LaunchDaemons/LaunchAgents, shell profiles, SSH authorized_keys, cron tabs, and hidden paths under root's home directory. SSFileCopyReceiver performs file writes with root authority on behalf of a remote viewer.Pre-authentication exploitation of the Screen Sharing service (CVE-2026-65400) abuses this write primitive to establish persistence; observed in-the-wild activity dropped LaunchDaemons and modified shell startup files to run a cryptocurrency miner as root.
Detection Logic
from logs-endpoint.events.file-* METADATA _id, _index, _version
| WHERE host.os.type == "macos"
AND event.type != "deletion"
AND process.name == "SSFileCopyReceiver"
AND (
file.path LIKE "/Library/LaunchDaemons/*.plist"
OR file.path LIKE "/Library/LaunchAgents/*.plist"
OR file.path LIKE "/Users/*/Library/LaunchAgents/*.plist"
OR file.path LIKE "/private/var/*/Library/LaunchAgents/*.plist"
OR file.name IN (".zshenv", ".zshrc", ".zprofile", ".zlogin", ".bashrc", ".bash_profile", ".bash_login", ".profile", "config.fish", "environment.plist")
OR file.path LIKE "/Users/*/.ssh/authorized_keys"
OR file.path LIKE "/private/var/root/.ssh/authorized_keys"
OR file.path LIKE "/private/etc/ssh/sshd_config*"
OR file.path LIKE "/private/var/at/tabs/*"
OR file.path LIKE "/var/at/tabs/*"
OR file.path LIKE "/private/var/root/.*/*"
OR file.path LIKE "/var/root/.*/*"
OR file.path LIKE "/private/var/root/.*"
OR file.path LIKE "/var/root/.*"
)
| KEEP _id, _index, _version,
@timestamp, host.name, host.id, user.id, user.name, process.name,
event.action, event.type, file.path, file.name, data_stream.namespace Field Validations
Loading…
Comments (0)
Loading comments...