detection.wiki

Detection rules › Sigma

macOS ESF Deletion In Sensitive Directories

Status
experimental
Severity
medium
Log source
product macos, service endpointsecurity
Author
Eric Brown - Nebulock, Inc.
Source
github.com/Nebulock-Inc/macos-coresigma

Detect unlink (delete) operations in sensitive directories such as LaunchAgents/Daemons or system configs.

Known false positives

  • legitimate maintenance or upgrades

MITRE ATT&CK coverage

TacticTechniques
Stealth

Rule body

title: macOS ESF Deletion In Sensitive Directories
id: 52b5612d-3c9e-4a4a-9b7a-1b6f94b6a0aa
status: experimental
description: Detect unlink (delete) operations in sensitive directories such as LaunchAgents/Daemons
  or system configs.
author: Eric Brown - Nebulock, Inc.
date: 2025-10-29
logsource:
  product: macos
  service: endpointsecurity
level: medium
detection:
  selection_evt:
    esf.event_type: 19
    event.action: unlink
  selection_path:
    TargetFilename|startswith:
    - /Library/LaunchDaemons/
    - /Library/LaunchAgents/
    - /System/Library/LaunchDaemons/
    - /etc/
  condition: selection_evt and selection_path
falsepositives:
- legitimate maintenance or upgrades
modified: 2025/01/15

Stages and Predicates

Stage 0: condition

selection_evt and selection_path

Stage 1: selection_evt

selection_evt:
  esf.event_type: 19
  event.action: unlink

Stage 2: selection_path

selection_path:
  TargetFilename|startswith:
  - /Library/LaunchDaemons/
  - /Library/LaunchAgents/
  - /System/Library/LaunchDaemons/
  - /etc/

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
TargetFilenamestarts_with
  • /Library/LaunchAgents/
  • /Library/LaunchDaemons/
  • /System/Library/LaunchDaemons/
  • /etc/
field:"TargetFilename" kind:starts_with
esf.event_typeeq
  • 19
field:"esf.event_type" kind:eq value:"19"
event.actioneq
  • unlink
field:"EventType" kind:eq value:"unlink"