Detection rules › Panther
MacOS Keyboard Events
A Key Logger has potentially been detected on a macOS system
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Collection | T1056 Input Capture |
Rule body yaml
AnalysisType: rule
Filename: osquery_mac_osx_attacks_keyboard_events.py
RuleID: "Osquery.Mac.OSXAttacksKeyboardEvents"
DisplayName: "MacOS Keyboard Events"
Enabled: true
LogTypes:
- Osquery.Differential
Tags:
- Osquery
- MacOS
- Malware
- Collection:Input Capture
Reports:
MITRE ATT&CK:
- TA0009:T1056
Severity: Medium
Description: A Key Logger has potentially been detected on a macOS system
Runbook: Verify the Application monitoring the keyboard taps
Reference: https://support.apple.com/en-us/HT204899
SummaryAttributes:
- name
- hostIdentifier
- action
Tests:
- Name: App running on Desktop that is watching keyboard events
ExpectedResult: true
Log:
{
"name": "pack_osx-attacks_Keyboard_Event_Taps",
"action": "added",
"hostIdentifier": "test-host",
"columns":
{
"path": "/Users/johnny/Desktop/Siri.app/Contents/MacOS/Siri",
"pid": 100,
"name": "Siri",
},
}
- Name: App is running from approved path
ExpectedResult: false
Log:
{
"name": "pack_osx-attacks_Keyboard_Event_Taps",
"action": "added",
"hostIdentifier": "test-host",
"columns":
{
"path": "/System/Library/CoreServices/Siri.app/Contents/MacOS/Siri",
"pid": 100,
"name": "Siri",
},
}
- Name: Unrelated query does not alert
ExpectedResult: false
Log:
{
"action": "added",
"calendarTime": "2020-04-10 23:26:11.000000000",
"columns":
{
"blocks_size": "4096",
"inodes": "2448101320",
"path": "/",
"blocks": "61202533",
"blocks_available": "22755926",
"blocks_free": "58479522",
"device": "/dev/disk1s5",
"device_alias": "/dev/disk1s5",
"flags": "75550721",
"inodes_free": "2447613763",
"type": "apfs",
},
"counter": 28,
"decorations":
{
"host_uuid": "0ec3540f-1dd9-4462-bd28-0f63b2611621",
"hostname": "MacBook-Pro.local",
},
"epoch": 0,
"hostIdentifier": "MacBook-Pro.local",
"name": "pack/incident-response/mounts",
"unixTime": 1586561171,
}
Detection logic
Condition
name contains "Keyboard_Event_Taps"
action eq "added"
columns.path ne ""
columns.name not in "Adobe Photoshop CC 2019"
not (columns.path wildcard "/System/*" or columns.path wildcard "/usr/*" or columns.path wildcard "/bin/*" or columns.path wildcard "/sbin/*" or columns.path wildcard "/var/*")
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
columns.path | starts_with | /System/ |
columns.path | starts_with | /bin/ |
columns.path | starts_with | /sbin/ |
columns.path | starts_with | /usr/ |
columns.path | starts_with | /var/ |
columns.name | eq | Adobe Photoshop CC 2019 |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field |
|---|
hostIdentifier |