Detection rules › Panther
MacOS ALF is misconfigured
The application level firewall blocks unwanted network connections made to your computer from other computers on your network.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth | T1562 Impair Defenses |
Rule body yaml
AnalysisType: rule
Filename: osquery_mac_application_firewall.py
RuleID: "Osquery.Mac.ApplicationFirewallSettings"
DisplayName: "MacOS ALF is misconfigured"
Enabled: true
LogTypes:
- Osquery.Differential
Tags:
- Osquery
- MacOS
- Security Control
- Defense Evasion:Impair Defenses
Reports:
CIS:
- 2.6.3
- 2.6.4
MITRE ATT&CK:
- TA0005:T1562
Severity: High
Description: >
The application level firewall blocks unwanted network connections made to your
computer from other computers on your network.
Runbook: Re-enable the firewall manually or with configuration management
Reference: https://support.apple.com/en-us/HT201642
SummaryAttributes:
- name
- hostIdentifier
- action
Tests:
- Name: ALF Disabled
ExpectedResult: true
Log:
{
"name": "pack_incident-response_alf",
"action": "added",
"hostIdentifier": "test-host",
"columns":
{
"logging_enabled": "0",
"stealth_enabled": "0",
"firewall_unload": "0",
"allow_signed_enabled": "0",
"global_state": "0",
"logging_option": "0",
"version": "1.6",
},
}
- Name: ALF Enabled
ExpectedResult: false
Log:
{
"name": "pack_incident-response_alf",
"action": "added",
"hostIdentifier": "test-host",
"columns":
{
"logging_enabled": "1",
"stealth_enabled": "1",
"firewall_unload": "0",
"allow_signed_enabled": "1",
"global_state": "1",
"logging_option": "0",
"version": "1.6",
},
}
Detection logic
Condition
name in ["pack_incident-response_alf", "pack/mac-cis/ApplicationFirewall"]
action eq "added"
columns.global_state eq "0" or columns.stealth_enabled eq "0"
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
action | eq |
|
columns.global_state | eq |
|
columns.stealth_enabled | eq |
|
name | in |
|
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field |
|---|
hostIdentifier |