Elastic low stable eql

Virtual Private Network Connection Attempt

Identifies the execution of macOS built-in commands to connect to an existing Virtual Private Network (VPN). Adversaries may use VPN connections to laterally move and control remote systems on a network.

View Source

Detection Logic

process where host.os.type == "macos" and event.type in ("start", "process_started") and
  (
    (process.name == "networksetup" and process.args like~ "-connectpppoeservice") or
    (process.name == "scutil" and process.args like~ "--nc" and process.args like~ "start") or
    (process.name == "osascript" and process.command_line : "osascript*set VPN to service*")
  )

Field Validations

Loading…

Comments (0)

Loading comments...