Detection rules › Splunk
MacOS LOLbin
The following analytic detects multiple executions of Living off the Land (LOLbin) binaries on macOS within a short period. It leverages osquery to monitor process events and identifies commands such as "find", "crontab", "screencapture", "openssl", "curl", "wget", "killall", and "funzip". This activity is significant as LOLbins are often used by attackers to perform malicious actions while evading detection. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, or persist within the environment, posing a significant security risk.
Known false positives
- No false positives have been identified at this time.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution |
Rule body
name: MacOS LOLbin
id: 58d270fb-5b39-418e-a855-4b8ac046805e
version: 13
creation_date: '2022-03-04'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: TTP
description: 'The following analytic detects multiple executions of Living off the Land (LOLbin) binaries on macOS within a short period.
It leverages osquery to monitor process events and identifies commands such as "find", "crontab", "screencapture", "openssl", "curl", "wget", "killall", and "funzip". This activity is significant as LOLbins are often used by attackers to perform malicious actions while evading detection.
If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, or persist within the environment, posing a significant security risk.'
data_source:
- Osquery Results
search: "`osquery_macro`\nname=es_process_events\ncolumns.cmdline IN (\n \"chmod*\",\n \"crontab*\",\n \"curl*\",\n \"find*\",\n \"funzip*\",\n \"killall*\",\n \"openssl*\",\n \"screencapture*\",\n \"wget*\",\n)\n| rename columns.* as *\n| stats count min(_time) as firstTime\n max(_time) as lastTime\n values(cmdline) as cmdline\n values(pid) as pid\n values(parent) as parent\n values(path) as path\n values(signing_id) as signing_id\n dc(path) as dc_path\n BY username host\n\n| rename username as user\n cmdline as process\n path as process_path\n host as dest\n\n| where dc_path > 3\n| `security_content_ctime(firstTime)`\n| `security_content_ctime(lastTime)`\n| `macos_lolbin_filter`"
how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
known_false_positives: No false positives have been identified at this time.
references:
- https://osquery.readthedocs.io/en/stable/deployment/process-auditing/
finding:
title: Multiplle LOLbin are executed on host $dest$ by user $user$
entity:
field: user
type: user
score: 50
intermediate_findings:
entities:
- field: dest
type: system
score: 50
message: Multiplle LOLbin are executed on host $dest$ by user $user$
analytic_story:
- Living Off The Land
- Hellcat Ransomware
- Axios Supply Chain Post Compromise
asset_type: Endpoint
mitre_attack_id:
- T1059.004
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
category: endpoint
security_domain: endpoint
Stages and Predicates
Stage 1: search
`osquery_macro`
name=es_process_events
columns.cmdline IN (
"chmod*",
"crontab*",
"curl*",
"find*",
"funzip*",
"killall*",
"openssl*",
"screencapture*",
"wget*",
)
Stage 2: rename
| rename columns.* as *
Stage 3: stats
| stats count min(_time) as firstTime
max(_time) as lastTime
values(cmdline) as cmdline
values(pid) as pid
values(parent) as parent
values(path) as path
values(signing_id) as signing_id
dc(path) as dc_path
BY username host
Stage 4: rename
| rename username as user
cmdline as process
path as process_path
host as dest
Stage 5: where
| where dc_path > 3
Stage 6: search
| `security_content_ctime(firstTime)`
Stage 7: search
| `security_content_ctime(lastTime)`
Stage 8: search
| `macos_lolbin_filter`
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
columns.cmdline | in |
| field:"columns.cmdline" kind:in |
dc_path | gt |
| field:"dc_path" kind:gt value:"3" |
name | eq |
| field:"name" kind:eq value:"es_process_events" |
sourcetype | eq |
| field:"sourcetype" kind:eq value:"osquery:results" |