Skip to content

Commit 8050483

Browse files
RavenTaitnasbench
RavenTait
and
nasbench
authored
Snap Mac Detections (#3935)
* Snap Mac Detections * add osquery * Update links and formatting * update datasource name * update formatting * bump version * Updates per PR comments * Add commandline to RBA for gatekeeper bypass --------- Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com> Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>
1 parent 8d25102 commit 8050483

19 files changed

Lines changed: 931 additions & 34 deletions

‎contentctl.yml‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,7 @@ apps:
9292
version: 1.3.0
9393
description: description of app
9494
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-iis_130.tgz
95-
- uid: 4242
95+
- uid: 6994
9696
title: CCX Add-on for Suricata
9797
appid: SPLUNK_TA_FOR_SURICATA
9898
version: 1.0.1
@@ -250,6 +250,12 @@ apps:
250250
version: 0.1.2
251251
description: description of app
252252
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/mcp-ta_012.tgz
253+
- uid: 8574
254+
title: TA-osquery
255+
appid: ta-osquery
256+
version: 1.0.4
257+
description: description of app
258+
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/ta-osquery_104.tgz
253259
githash: d6fac80e6d50ae06b40f91519a98489d4ce3a3fd
254260
test_data_caches:
255261
- base_url: https://media.githubusercontent.com/media/splunk/attack_data/master/

data_sources/osquery.yml renamed to data_sources/osquery_results.yml

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
1-
name: osquery
1+
name: Osquery Results
22
id: 7ec4d7c8-c1d0-423a-9169-261f6adb74c0
3-
version: 2
4-
date: '2025-01-23'
3+
version: 3
4+
date: '2026-04-13'
55
author: Patrick Bareiss, Splunk
66
description: Logs system queries performed using osquery, including details about
77
processes, file access, network activity, and system configurations.
@@ -13,7 +13,10 @@ mitre_components:
1313
- Application Log Content
1414
source: osquery
1515
sourcetype: osquery:results
16-
supported_TA: []
16+
supported_TA:
17+
- name: TA-osquery
18+
url: https://splunkbase.splunk.com/app/8574
19+
version: 1.0.4
1720
fields:
1821
- _time
1922
- calendarTime

‎detections/endpoint/macos_account_created.yml‎

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
name: MacOS Account Created
2+
id: 491004ae-694f-453e-b1e0-fc1e65daeea1
3+
version: 1
4+
date: '2026-02-26'
5+
author: Raven Tait, Splunk
6+
status: production
7+
type: Anomaly
8+
description: |-
9+
The following analytic detects the creation of a new local user account on a MacOS system. It leverages osquery logs to identify this activity.
10+
Monitoring the creation of local accounts is crucial for a SOC as it can indicate unauthorized access or lateral movement within the network.
11+
If confirmed malicious, this activity could allow an attacker to establish persistence, escalate privileges, or gain unauthorized access to sensitive systems and data.
12+
data_source:
13+
- Osquery Results
14+
search: |-
15+
| tstats `security_content_summariesonly`
16+
count min(_time) as firstTime
17+
max(_time) as lastTime
18+
from datamodel=Endpoint.Processes where
19+
20+
(
21+
Processes.process = "*sysadminctl"
22+
Processes.process = "*-addUser*"
23+
)
24+
OR
25+
(
26+
Processes.process = "*createhomedir*"
27+
Processes.process = "*-u*"
28+
)
29+
OR
30+
(
31+
Processes.process = "*dseditgroup*"
32+
Processes.process IN (
33+
"*edit*",
34+
"*-a*"
35+
)
36+
)
37+
OR
38+
(
39+
Processes.process = "*dscl*"
40+
Processes.process = "*-create*"
41+
)
42+
43+
by Processes.dest Processes.original_file_name Processes.parent_process_id
44+
Processes.process Processes.process_exec Processes.process_guid
45+
Processes.process_hash Processes.process_id
46+
Processes.process_current_directory Processes.process_name
47+
Processes.process_path Processes.user Processes.user_id
48+
Processes.vendor_product
49+
50+
| `drop_dm_object_name(Processes)`
51+
| `security_content_ctime(firstTime)`
52+
| `security_content_ctime(lastTime)`
53+
| `macos_account_created_filter`
54+
how_to_implement: |-
55+
This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
56+
Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
57+
known_false_positives: |-
58+
Creating new accounts after initial endpoint management should be rare in most environments. Investigate and tune as needed.
59+
references:
60+
- https://osquery.readthedocs.io/en/stable/deployment/process-auditing/
61+
- https://ss64.com/mac/sysadminctl.html
62+
- https://ss64.com/mac/dseditgroup.html
63+
- https://ss64.com/mac/dscl.html
64+
drilldown_searches:
65+
- name: View the detection results for - "$user$" and "$dest$"
66+
search: '%original_detection_search% | search user = "$user$" dest = "$dest$"'
67+
earliest_offset: $info_min_time$
68+
latest_offset: $info_max_time$
69+
- name: View risk events for the last 7 days for - "$user$" and "$dest$"
70+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
71+
earliest_offset: $info_min_time$
72+
latest_offset: $info_max_time$
73+
rba:
74+
message: New local account created on $dest$ by $user$ via $process$
75+
risk_objects:
76+
- field: user
77+
type: user
78+
score: 20
79+
- field: dest
80+
type: system
81+
score: 20
82+
threat_objects:
83+
- field: process
84+
type: process
85+
tags:
86+
analytic_story:
87+
- MacOS Persistence Techniques
88+
asset_type: Endpoint
89+
mitre_attack_id:
90+
- T1136
91+
product:
92+
- Splunk Enterprise
93+
- Splunk Enterprise Security
94+
- Splunk Cloud
95+
security_domain: endpoint
96+
tests:
97+
- name: True Positive Test
98+
attack_data:
99+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136/osquery_account_creation/osquery.log
100+
source: osquery
101+
sourcetype: osquery:results

‎detections/endpoint/macos_amos_stealer___virtual_machine_check_activity.yml‎

Lines changed: 17 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,32 +1,42 @@
11
name: MacOS AMOS Stealer - Virtual Machine Check Activity
22
id: 4e41ad21-9761-426d-8aa1-083712ff9f30
3-
version: 5
4-
date: '2026-03-10'
3+
version: 6
4+
date: '2026-04-13'
55
author: Nasreddine Bencherchali, Splunk, Alex Karkins
66
status: production
77
type: Anomaly
88
description: |
9-
The following analytic detects AMOS Stealer VM check activity on macOS. It leverages osquery to monitor process events and identifies the execution of the "osascript" command along with specific commandline strings. This activity is significant
10-
as AMOS stealer was seen using this pattern in order to check if the host is a Virtual Machine or not. If confirmed malicious, this behavior indicate that the host is already infected by the AMOS stealer, which could allow attackers to execute arbitrary code, escalate privileges, steal information, or persist within the environment, posing a significant security risk.
9+
The following analytic detects AMOS Stealer VM check activity on macOS. It leverages osquery to monitor process events and identifies the execution of the "osascript" command along with specific commandline strings.
10+
This activity is significant as AMOS stealer was seen using this pattern in order to check if the host is a Virtual Machine or not.
11+
If confirmed malicious, this behavior indicate that the host is already infected by the AMOS stealer, which could allow attackers to execute arbitrary code, escalate privileges, steal information, or persist within the environment, posing a significant security risk.
1112
data_source:
12-
- osquery
13+
- Osquery Results
1314
search: |
14-
`osquery_macro` name=es_process_events
15-
columns.cmdline="*osascript*" AND columns.cmdline="* -e *" AND columns.cmdline="*set*" AND columns.cmdline="*system_profiler*" AND columns.cmdline IN ("*VMware*", "*QEMU*")
15+
`osquery_macro`
16+
name=es_process_events
17+
columns.cmdline="*osascript*"
18+
columns.cmdline="* -e *"
19+
columns.cmdline="*set*"
20+
columns.cmdline="*system_profiler*"
21+
columns.cmdline IN ("*VMware*", "*QEMU*")
22+
1623
| rename columns.* as *
24+
1725
| stats min(_time) as firstTime max(_time) as lastTime
1826
values(cmdline) as cmdline,
1927
values(pid) as pid,
2028
values(parent) as parent,
2129
values(path) as path,
2230
values(signing_id) as signing_id,
2331
by username host
32+
2433
| rename
2534
username as user,
2635
cmdline as process,
2736
parent as parent_process,
2837
path as process_path,
2938
host as dest
39+
3040
| `security_content_ctime(firstTime)`
3141
| `security_content_ctime(lastTime)`
3242
| `macos_amos_stealer___virtual_machine_check_activity_filter`

‎detections/endpoint/macos_data_chunking.yml‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
name: MacOS Data Chunking
2+
id: 7f1c8bed-9bd4-40b0-a1df-c262cbade0fc
3+
version: 1
4+
date: '2026-02-26'
5+
author: Raven Tait, Splunk
6+
status: production
7+
type: Anomaly
8+
description: |-
9+
The following analytic detects suspicious data chunking activities that involve the use of split or dd, potentially indicating an attempt to evade detection by breaking large files into smaller parts.
10+
Attackers may use this technique to bypass size-based security controls, facilitating the covert exfiltration of sensitive data.
11+
By monitoring for unusual or unauthorized use of these commands, this analytic helps identify potential data exfiltration attempts, allowing security teams to intervene and prevent the unauthorized transfer of critical information from the network.
12+
data_source:
13+
- Osquery Results
14+
search: |-
15+
| tstats `security_content_summariesonly`
16+
count min(_time) as firstTime
17+
max(_time) as lastTime
18+
19+
from datamodel=Endpoint.Processes where
20+
21+
(
22+
Processes.process = "dd *"
23+
Processes.process = "* if=*"
24+
)
25+
OR
26+
(
27+
Processes.process = "*split *"
28+
Processes.process="* -b *"
29+
)
30+
31+
by Processes.dest Processes.original_file_name Processes.parent_process_id
32+
Processes.process Processes.process_exec Processes.process_guid
33+
Processes.process_hash Processes.process_id
34+
Processes.process_current_directory Processes.process_name
35+
Processes.process_path Processes.user
36+
Processes.user_id Processes.vendor_product
37+
38+
| `drop_dm_object_name(Processes)`
39+
| `security_content_ctime(firstTime)`
40+
| `security_content_ctime(lastTime)`
41+
| `macos_data_chunking_filter`
42+
how_to_implement: |-
43+
This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
44+
Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
45+
known_false_positives: |-
46+
Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
47+
references:
48+
- https://osquery.readthedocs.io/en/stable/deployment/process-auditing/
49+
- https://ss64.com/mac/dd.html
50+
- https://ss64.com/mac/split.html
51+
drilldown_searches:
52+
- name: View the detection results for - "$user$" and "$dest$"
53+
search: '%original_detection_search% | search user = "$user$" dest = "$dest$"'
54+
earliest_offset: $info_min_time$
55+
latest_offset: $info_max_time$
56+
- name: View risk events for the last 7 days for - "$user$" and "$dest$"
57+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
58+
earliest_offset: $info_min_time$
59+
latest_offset: $info_max_time$
60+
rba:
61+
message: A file was split on $dest$ by $user$ via $process$
62+
risk_objects:
63+
- field: user
64+
type: user
65+
score: 20
66+
- field: dest
67+
type: system
68+
score: 20
69+
threat_objects:
70+
- field: process
71+
type: process
72+
tags:
73+
analytic_story:
74+
- MacOS Post-Exploitation
75+
asset_type: Endpoint
76+
mitre_attack_id:
77+
- T1030
78+
product:
79+
- Splunk Enterprise
80+
- Splunk Enterprise Security
81+
- Splunk Cloud
82+
security_domain: endpoint
83+
tests:
84+
- name: True Positive Test
85+
attack_data:
86+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1030/osquery_data_chunking/osquery.log
87+
source: osquery
88+
sourcetype: osquery:results

‎detections/endpoint/macos_gatekeeper_bypass.yml‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
name: MacOS Gatekeeper Bypass
2+
id: 2c9346f3-bbeb-48ce-8411-fc13d09d83a5
3+
version: 1
4+
date: '2026-02-26'
5+
author: Raven Tait, Splunk
6+
status: production
7+
type: Anomaly
8+
description: |-
9+
Detects known MacOS security bypass techniques that may be used to enable malicious code execution.
10+
Specifically monitors for attempts to remove the com.apple.quarantine attribute using xattr, or to disable Gatekeeper protections via spctl --master-disable, both of which can allow untrusted or malicious applications to execute without standard system safeguards.
11+
data_source:
12+
- Osquery Results
13+
search: |-
14+
| tstats `security_content_summariesonly`
15+
count min(_time) as firstTime
16+
max(_time) as lastTime
17+
18+
from datamodel=Endpoint.Processes where
19+
20+
(
21+
Processes.process = "*xattr*"
22+
Processes.process = "*com.apple.quarantine*"
23+
)
24+
OR
25+
(
26+
Processes.process = "*spctl*"
27+
Processes.process = "*master-disable*"
28+
)
29+
30+
by Processes.dest Processes.original_file_name Processes.parent_process_id
31+
Processes.process Processes.process_exec Processes.process_guid
32+
Processes.process_hash Processes.process_id
33+
Processes.process_current_directory Processes.process_name
34+
Processes.process_path Processes.user
35+
Processes.user_id Processes.vendor_product
36+
37+
| `drop_dm_object_name(Processes)`
38+
| `security_content_ctime(firstTime)`
39+
| `security_content_ctime(lastTime)`
40+
| `macos_gatekeeper_bypass_filter`
41+
how_to_implement: |-
42+
This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
43+
Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
44+
known_false_positives: |-
45+
Administrators or power users may need to disable Gatekeeper to install unsigned tools.
46+
references:
47+
- https://osquery.readthedocs.io/en/stable/deployment/process-auditing/
48+
- https://ss64.com/mac/xattr.html
49+
- https://ss64.com/mac/spctl.html
50+
drilldown_searches:
51+
- name: View the detection results for - "$user$" and "$dest$"
52+
search: '%original_detection_search% | search user = "$user$" dest = "$dest$"'
53+
earliest_offset: $info_min_time$
54+
latest_offset: $info_max_time$
55+
- name: View risk events for the last 7 days for - "$user$" and "$dest$"
56+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
57+
earliest_offset: $info_min_time$
58+
latest_offset: $info_max_time$
59+
rba:
60+
message: Attempt to bypass gatekeeper protections on $dest$ by $user$ via $process$
61+
risk_objects:
62+
- field: user
63+
type: user
64+
score: 20
65+
- field: dest
66+
type: system
67+
score: 20
68+
threat_objects:
69+
- field: process
70+
type: process
71+
tags:
72+
analytic_story:
73+
- MacOS Privilege Escalation
74+
- MacOS Post-Exploitation
75+
- MacOS Persistence Techniques
76+
asset_type: Endpoint
77+
mitre_attack_id:
78+
- T1553.001
79+
product:
80+
- Splunk Enterprise
81+
- Splunk Enterprise Security
82+
- Splunk Cloud
83+
security_domain: endpoint
84+
tests:
85+
- name: True Positive Test
86+
attack_data:
87+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1553.001/osquery_gatekeeper/osquery.log
88+
source: osquery
89+
sourcetype: osquery:results

0 commit comments

Comments
 (0)