Elastic medium stable kql

SSFileCopySender Executed as Root

Identifies execution of the macOS Screen Sharing file-copy helper SSFileCopySender with root UID/GID attributes (0 80). Under the native Apple authentication path this helper runs in the connecting user's context; execution as root is anomalous and consistent with pre-authentication exploitation of the Screen Sharing service (CVE-2026-65400), where a flawed SRP validation path lets an unauthenticated attacker reach privileged file operations. Note that the 0/80 UID/GID pair reflects only initial exploitation attempts and can be evaded once an attacker enumerates another local account. It is advisable to treat this as a tripwire and pair it with the SSFileCopyReceiver Writing to Common Persistence Locations rule coverage.

View Source

Detection Logic

from logs-endpoint.events.process-* METADATA _id, _index, _version
| WHERE host.os.type == "macos"
    
AND event.type == "start"
    
AND process.name == "SSFileCopySender"
    
AND KQL(""" process.args : "0" 
AND process.args : "80" """)
| KEEP _id, _version, _index,
    @timestamp,
    data_stream.namespace,
    host.name,
    host.id,
    user.id,
    user.name,
    process.name,
    process.entity_id,
    process.parent.name,
    process.command_line
| SORT @timestamp DESC
| LIMIT 100

Field Validations

Loading…

Comments (0)

Loading comments...