macOS Remote Execution Tools

Status: experimental
Severity: low
Log source: product macos, service endpointsecurity
Author: Eric Brown - Nebulock, Inc.
Source: github.com/Nebulock-Inc/macos-coresigma

Detects execution of remote execution and terminal multiplexer tools (screen, tmux) often used by adversaries for maintaining persistent sessions or executing commands on remote systems during lateral movement.

Known false positives

Legitimate use of terminal multiplexers by developers and administrators
Automated scripts using expect for interactive command execution
Remote administration sessions

MITRE ATT&CK coverage

Tactic	Techniques
Lateral Movement	`T1021` Remote Services `T1563` Remote Service Session Hijacking

Rule body

title: macOS Remote Execution Tools
id: a52677c9-2670-428b-919a-95df34338e2c
status: experimental
description: 'Detects execution of remote execution and terminal multiplexer tools
  (screen, tmux)

  often used by adversaries for maintaining persistent sessions or executing commands

  on remote systems during lateral movement.

  '
author: Eric Brown - Nebulock, Inc.
date: 2025/10/31
modified: 2025/10/31
references:
- https://attack.mitre.org/techniques/T1021/
- https://attack.mitre.org/techniques/T1563/
logsource:
  product: macos
  service: endpointsecurity
detection:
  selection_event:
    esf.event_type: 9
    event.action: exec
  selection_process:
    Image|endswith:
    - /screen
    - /tmux
    - /expect
  condition: selection_event and selection_process
falsepositives:
- Legitimate use of terminal multiplexers by developers and administrators
- Automated scripts using expect for interactive command execution
- Remote administration sessions
fields:
- Image
- CommandLine
- ProcessId
- ParentProcessId
- User
tags:
- attack.lateral_movement
- attack.t1021
- attack.t1563
level: low

Stages and Predicates

Stage 0: `condition`

selection_event and selection_process

Stage 1: `selection_event`

selection_event:
  esf.event_type: 9
  event.action: exec

Stage 2: `selection_process`

selection_process:
  Image|endswith:
  - /screen
  - /tmux
  - /expect

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`/expect` `/screen` `/tmux`	`field:"Image" kind:ends_with`
`esf.event_type`	eq	`9`	`field:"esf.event_type" kind:eq value:"9"`
`event.action`	eq	`exec`	`field:"EventType" kind:eq value:"exec"`