Detection rules › Panther

MacOS Keyboard Events

Severity
medium
Log types
Osquery.Differential
Tags
Osquery, MacOS, Malware, Collection:Input Capture
Reference
https://support.apple.com/en-us/HT204899
Source
github.com/panther-labs/panther-analysis

A Key Logger has potentially been detected on a macOS system

MITRE ATT&CK coverage

TacticTechniques
CollectionT1056 Input Capture

Rule body yaml

AnalysisType: rule
Filename: osquery_mac_osx_attacks_keyboard_events.py
RuleID: "Osquery.Mac.OSXAttacksKeyboardEvents"
DisplayName: "MacOS Keyboard Events"
Enabled: true
LogTypes:
  - Osquery.Differential
Tags:
  - Osquery
  - MacOS
  - Malware
  - Collection:Input Capture
Reports:
  MITRE ATT&CK:
    - TA0009:T1056
Severity: Medium
Description: A Key Logger has potentially been detected on a macOS system
Runbook: Verify the Application monitoring the keyboard taps
Reference: https://support.apple.com/en-us/HT204899
SummaryAttributes:
  - name
  - hostIdentifier
  - action
Tests:
  - Name: App running on Desktop that is watching keyboard events
    ExpectedResult: true
    Log:
      {
        "name": "pack_osx-attacks_Keyboard_Event_Taps",
        "action": "added",
        "hostIdentifier": "test-host",
        "columns":
          {
            "path": "/Users/johnny/Desktop/Siri.app/Contents/MacOS/Siri",
            "pid": 100,
            "name": "Siri",
          },
      }
  - Name: App is running from approved path
    ExpectedResult: false
    Log:
      {
        "name": "pack_osx-attacks_Keyboard_Event_Taps",
        "action": "added",
        "hostIdentifier": "test-host",
        "columns":
          {
            "path": "/System/Library/CoreServices/Siri.app/Contents/MacOS/Siri",
            "pid": 100,
            "name": "Siri",
          },
      }
  - Name: Unrelated query does not alert
    ExpectedResult: false
    Log:
      {
        "action": "added",
        "calendarTime": "2020-04-10 23:26:11.000000000",
        "columns":
          {
            "blocks_size": "4096",
            "inodes": "2448101320",
            "path": "/",
            "blocks": "61202533",
            "blocks_available": "22755926",
            "blocks_free": "58479522",
            "device": "/dev/disk1s5",
            "device_alias": "/dev/disk1s5",
            "flags": "75550721",
            "inodes_free": "2447613763",
            "type": "apfs",
          },
        "counter": 28,
        "decorations":
          {
            "host_uuid": "0ec3540f-1dd9-4462-bd28-0f63b2611621",
            "hostname": "MacBook-Pro.local",
          },
        "epoch": 0,
        "hostIdentifier": "MacBook-Pro.local",
        "name": "pack/incident-response/mounts",
        "unixTime": 1586561171,
      }

Detection logic

Condition

name contains "Keyboard_Event_Taps"
action eq "added"
columns.path ne ""
columns.name not in "Adobe Photoshop CC 2019"
not (columns.path wildcard "/System/*" or columns.path wildcard "/usr/*" or columns.path wildcard "/bin/*" or columns.path wildcard "/sbin/*" or columns.path wildcard "/var/*")

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
columns.pathstarts_with/System/
columns.pathstarts_with/bin/
columns.pathstarts_with/sbin/
columns.pathstarts_with/usr/
columns.pathstarts_with/var/
columns.nameeqAdobe Photoshop CC 2019

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
actioneq
  • added corpus 10 (panther 10)
namecontains
  • Keyboard_Event_Taps

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

Field
hostIdentifier