Plist File Modification T1647

Tactic: Defense Impairment

Adversaries may modify property list files (plist files) to enable other malicious activity, while also potentially evading and bypassing system defenses. macOS applications use plist files, such as the info.plist file, to store properties and configuration settings that inform the operating system how to handle the application at runtime. Plist files are structured metadata in key-value pairs formatted in XML based on Apple's Core Foundation DTD. Plist files can be saved in text or binary format.

Authoring guide

Patterns shared across the 6 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (11 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
host.os.type5eq 5
event.type4in 3, ne 1process_started, start, deletion
process_name3eq 3defaults, osascript
CommandLine2contains 1, wildcard 1com.apple.safari, includedevelopmenu, javascript, osascript*login item*hidden:true*
file.name2eq 2SyncedRules.plist, com.apple.loginwindow.plist
process.args2eq 2-bool, /Library/Preferences/com.apple.SoftwareUpdate.plist, com.apple.SoftwareUpdate, write
TargetFilename1wildcard 1/users/*/library/mail/*/maildata/syncedrules.plist, /users/*/library/mobile...
columns.path1eq 1/usr/bin/plutil
event.category1eq 1file
name1eq 1es_process_events
sourcetype1eq 1osquery:results

Top indicator values (21 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

FieldKindValueRules (here)Corpus reach
event.typein
process_started
340
event.typein
start
342
process.argseq
write
23
process.argseq
-bool
1
process.argseq
/Library/Preferences/com.apple.SoftwareUpdate.plist
1
process.argseq
com.apple.SoftwareUpdate
1
process_nameeq
defaults
25
process_nameeq
osascript
110
CommandLinecontains
com.apple.safari
1
CommandLinecontains
includedevelopmenu
1
CommandLinecontains
javascript
14
CommandLinewildcard
osascript*login item*hidden:true*
1
TargetFilenamewildcard
/users/*/library/mail/*/maildata/syncedrules.plist
1
TargetFilenamewildcard
/users/*/library/mobile documents/com.apple.mail/data/*/maildata/syncedrules.plist
1
columns.patheq
/usr/bin/plutil
1
event.categoryeq
file
131
event.typene
deletion
128
file.nameeq
SyncedRules.plist
1
file.nameeq
com.apple.loginwindow.plist
1
nameeq
es_process_events
13
sourcetypeeq
osquery:results
13

Exclusions (24 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

FieldKindValueRules excluding
Imageeq
/applications/mail.app/contents/macos/mail
1
Imageeq
/sbin/launchd
1
Imageeq
/system/applications/mail.app/contents/macos/mail
1
Imageeq
/system/library/coreservices/backupd.bundle/contents/resources/backupd
1
Imageeq
/system/library/coreservices/finder.app/contents/macos/finder
1
Imageeq
/system/library/frameworks/fileprovider.framework/support/fileproviderd
1
Imageeq
/system/library/privateframeworks/clouddocsdaemon.framework/versions/a/support/bird
1
Imageeq
/usr/libexec/xpcproxy
1
event.typeeq
deletion
1
process.argseq
TRUE
1
process.argseq
true
1
process_namein
backupd
1
process_namein
cfprefsd
1
process_namein
clonekitservice
1
process_namein
desktopserviceshelper
1

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Platform (all)
Domain (all)

Elastic 5 rules

Splunk 1 rule