Plist File Modification T1647

Tactic: Defense Impairment

Adversaries may modify property list files (plist files) to enable other malicious activity, while also potentially evading and bypassing system defenses. macOS applications use plist files, such as the info.plist file, to store properties and configuration settings that inform the operating system how to handle the application at runtime. Plist files are structured metadata in key-value pairs formatted in XML based on Apple's Core Foundation DTD. Plist files can be saved in text or binary format.

Events covered

3 catalog events are tagged with this technique by at least one rule.

Authoring guide

These 14 rules share fields, values, and exclusions.

Fields filtered most (21 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
event.type7ne 4, in 3deletion, process_started, start
host.os.type7eq 7
process_name7eq 4, wildcard 3, in 1bash, chmod, curl, defaults, base64
EventType4eq 4, in 1exec, fork, launch_daemon, modification
TargetFilename4wildcard 4/library/launchagents/*, /library/launchdaemons/*, /system/library/launchagents/*, /library/launchagents/.*.plist, /library/launchdaemons/.*.plist
file.name4eq 3, wildcard 1*com.adobe*.plist, *com.apple*.plist, *com.dropbox*.plist, SyncedRules.plist, com.apple.dock.plist
CommandLine3contains 2, ends_with 1, wildcard 1 &, .amazonaws.com, .cloudfront.net, com.apple.safari, includedevelopmenu
process.args3eq 3, starts_with 1, wildcard 1*/bin/base64*-d*, */bin/chmod +x*, */bin/curl*.amazonaws.com*, -bool, /library/preferences/com.apple.softwareupdate.plist
process.code_signature.exists3eq 3false
process.code_signature.trusted3eq 3false
Image1starts_with 1/library/fonts/, /library/graphics/, /library/webserver/
Persistence.args1is_null 1
Persistence.keepalive1eq 1true
Persistence.runatload1eq 1true
columns.path1eq 1/usr/bin/plutil

Top indicator values (128 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
event.typene
deletion
432
event.typein
process_started
339
event.typein
start
341
process.code_signature.existseq
false
3119
process.code_signature.trustedeq
false
3115
process_namewildcard
osascript
332
process_namewildcard
python*
369
process_namewildcard
bash
237
process_namewildcard
curl
231
process_namewildcard
nscurl
214
process_namewildcard
sh
237
EventTypeeq
exec
2576
EventTypeeq
launch_daemon
15
EventTypeeq
modification
172
TargetFilenamewildcard
/library/launchagents/*
22
TargetFilenamewildcard
/library/launchdaemons/*
22
TargetFilenamewildcard
/system/library/launchagents/*
22
TargetFilenamewildcard
/system/library/launchdaemons/*
22
TargetFilenamewildcard
/users/*/library/launchagents/*
22
process.argseq
write
25
process_nameeq
defaults
27
CommandLinecontains
.amazonaws.com
1
CommandLinecontains
.cloudfront.net
1
CommandLinecontains
com.apple.safari
12
CommandLinecontains
includedevelopmenu
12
CommandLinecontains
javascript
15
CommandLinecontains
raw.githubusercontent.com
1
CommandLineends_with
&
1
CommandLinewildcard
osascript*login item*hidden:true*
1
EventTypein
exec
1201

Exclusions (107 distinct)

These values appear most often in top-level exclusions.

FieldKindValueRules excluding
CommandLinecontains
$cffixed_user_home/.zoterointegrationpipe
1
CommandLinewildcard
*http://127.0.0.1:6969/binary*ppShuttle_*.bin*
1
Imageeq
/applications/mail.app/contents/macos/mail
1
Imageeq
/bin/bash
1
Imageeq
/opt/chef/embedded/bin/ruby
1
Imageeq
/sbin/launchd
1
Imageeq
/system/applications/mail.app/contents/macos/mail
1
Imageeq
/system/library/coreservices/backupd.bundle/contents/resources/backupd
1
Imageeq
/system/library/coreservices/finder.app/contents/macos/finder
1
Imageeq
/system/library/frameworks/fileprovider.framework/support/fileproviderd
1
Imageeq
/system/library/privateframeworks/clouddocsdaemon.framework/versions/a/support/bird
1
Imageeq
/usr/libexec/xpcproxy
1
Imagein
/bin/bash
1
Imagein
/usr/bin/sed
1
Imagestarts_with
/library/privilegedhelpertools/
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: macOS

Domain: Endpoint

Elastic 12 rules

Splunk 1 rule

Panther 1 rule