Sigma informational test sigma

System Network Discovery - macOS

Detects enumeration of local network configuration

View Source

Detection Logic

{
  "selection_1": {
    "Image
| endswith": [
      "/arp",
      "/ifconfig",
      "/netstat",
      "/networksetup",
      "/socketfilterfw"
    ]
  },
  "selection_2": {
    "Image": "/usr/bin/defaults",
    "CommandLine
| contains
| all": [
      "/Library/Preferences/com.apple.alf",
      "read"
    ]
  },
  "filter_main_wifivelocityd": {
    "ParentImage
| endswith": "/wifivelocityd"
  },
  "condition": "1 of selection_* and not 1 of filter_main_*"
}

False Positives

  • ⚠ Legitimate administration activities

Field Validations

Loading…

Comments (0)

Loading comments...