Sigma medium test sigma

Suspicious MacOS Firmware Activity

Detects when a user manipulates with Firmward Password on MacOS. NOTE - this command has been disabled on silicon-based apple computers.

View Source

Detection Logic

{
  "selection1": {
    "Image": "/usr/sbin/firmwarepasswd",
    "CommandLine
| contains": [
      "setpasswd",
      "full",
      "delete",
      "check"
    ]
  },
  "condition": "selection1"
}

False Positives

⚠ Legitimate administration activities

Field Validations

Loading…

Comments (0)

Loading comments...