detection.wiki

Detection rules › Sigma

Potential Discovery Activity Using Find - MacOS

Status
test
Severity
medium
Log source
category process_creation, product macos
Author
Nasreddine Bencherchali (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects usage of "find" binary in a suspicious manner to perform discovery

MITRE ATT&CK coverage

TacticTechniques
Discovery

Telemetry coverage

PlatformRecord / event type
macOSESF event exec (NOTIFY): Fires after execve(2) or posix_spawn(2) succeeds, delivering a post-fact record of the new process.

Rule body

title: Potential Discovery Activity Using Find - MacOS
id: 85de3a19-b675-4a51-bfc6-b11a5186c971
related:
    - id: 8344c0e5-5783-47cc-9cf9-a0f7fd03e6cf
      type: similar
status: test
description: Detects usage of "find" binary in a suspicious manner to perform discovery
references:
    - https://github.com/SaiSathvik1/Linux-Privilege-Escalation-Notes
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-12-28
tags:
    - attack.discovery
    - attack.t1083
logsource:
    category: process_creation
    product: macos
detection:
    selection:
        Image|endswith: '/find'
        CommandLine|contains:
            - '-perm -4000'
            - '-perm -2000'
            - '-perm 0777'
            - '-perm -222'
            - '-perm -o w'
            - '-perm -o x'
            - '-perm -u=s'
            - '-perm -g=s'
    condition: selection
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    Image|endswith: '/find'
    CommandLine|contains:
        - '-perm -4000'
        - '-perm -2000'
        - '-perm 0777'
        - '-perm -222'
        - '-perm -o w'
        - '-perm -o x'
        - '-perm -u=s'
        - '-perm -g=s'

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
CommandLinematch
  • -perm -2000
  • -perm -222
  • -perm -4000
  • -perm -g=s
  • -perm -o w
  • -perm -o x
  • -perm -u=s
  • -perm 0777
field:"CommandLine" kind:match
Imageends_with
  • /find
field:"Image" kind:ends_with value:"/find"