macOS Encryption Tool Usage

Status: experimental
Severity: medium
Log source: product macos, service endpointsecurity
Author: Eric Brown - Nebulock, Inc.
Source: github.com/Nebulock-Inc/macos-coresigma

Detects execution of encryption tools (openssl, gpg, diskutil) which may indicate ransomware activity or data encryption for impact. Adversaries encrypt data to deny availability and extort victims. Also monitors disk encryption operations.

Known false positives

Legitimate data encryption for security
FileVault and disk encryption setup
Secure file transfer preparations
Development and testing of encryption features

MITRE ATT&CK coverage

Tactic	Techniques
Impact	`T1486` Data Encrypted for Impact `T1565.001` Data Manipulation: Stored Data Manipulation

Rule body

title: macOS Encryption Tool Usage
id: f2a3b4c5-d6e7-4f8a-9b0c-1d2e3f4a5b6c
status: experimental
description: 'Detects execution of encryption tools (openssl, gpg, diskutil) which
  may indicate

  ransomware activity or data encryption for impact. Adversaries encrypt data to

  deny availability and extort victims. Also monitors disk encryption operations.

  '
author: Eric Brown - Nebulock, Inc.
date: 2025/10/31
modified: 2025/10/31
references:
- https://attack.mitre.org/techniques/T1486/
- https://attack.mitre.org/techniques/T1565/001/
logsource:
  product: macos
  service: endpointsecurity
detection:
  selection_event:
    esf.event_type: 9
    event.action: exec
  selection_process:
    Image|endswith:
    - /openssl
    - /gpg
    - /gpg2
    - /diskutil
  selection_encryption:
    CommandLine|contains:
    - 'enc '
    - encrypt
    - aes
    - --cipher
    - apfs encryptVolume
    - coreStorage convert
  condition: selection_event and selection_process and selection_encryption
falsepositives:
- Legitimate data encryption for security
- FileVault and disk encryption setup
- Secure file transfer preparations
- Development and testing of encryption features
fields:
- Image
- CommandLine
- ProcessId
- ParentProcessId
- User
tags:
- attack.impact
- attack.t1486
- attack.t1565.001
level: medium

Stages and Predicates

Stage 0: `condition`

selection_event and selection_process and selection_encryption

Stage 1: `selection_event`

selection_event:
  esf.event_type: 9
  event.action: exec

Stage 2: `selection_process`

selection_process:
  Image|endswith:
  - /openssl
  - /gpg
  - /gpg2
  - /diskutil

Stage 3: `selection_encryption`

selection_encryption:
  CommandLine|contains:
  - 'enc '
  - encrypt
  - aes
  - --cipher
  - apfs encryptVolume
  - coreStorage convert

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`--cipher` `aes` `apfs encryptVolume` `coreStorage convert` `enc` `encrypt`	`field:"CommandLine" kind:match`
`Image`	ends_with	`/diskutil` `/gpg` `/gpg2` `/openssl`	`field:"Image" kind:ends_with`
`esf.event_type`	eq	`9`	`field:"esf.event_type" kind:eq value:"9"`
`event.action`	eq	`exec`	`field:"EventType" kind:eq value:"exec"`