Detection rules › Splunk
MacOS LOLbin
The following analytic detects multiple executions of Living off the Land (LOLbin) binaries on macOS within a short period. It leverages osquery to monitor process events and identifies commands such as "find", "crontab", "screencapture", "openssl", "curl", "wget", "killall", and "funzip". This activity is significant as LOLbins are often used by attackers to perform malicious actions while evading detection. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, or persist within the environment, posing a significant security risk.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | T1059.004 Command and Scripting Interpreter: Unix Shell |
Rule body splunk
name: MacOS LOLbin
id: 58d270fb-5b39-418e-a855-4b8ac046805e
version: 13
creation_date: '2022-03-04'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: TTP
description: 'The following analytic detects multiple executions of Living off the Land (LOLbin) binaries on macOS within a short period.
It leverages osquery to monitor process events and identifies commands such as "find", "crontab", "screencapture", "openssl", "curl", "wget", "killall", and "funzip". This activity is significant as LOLbins are often used by attackers to perform malicious actions while evading detection.
If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, or persist within the environment, posing a significant security risk.'
data_source:
- Osquery Results
search: "`osquery_macro`\nname=es_process_events\ncolumns.cmdline IN (\n \"chmod*\",\n \"crontab*\",\n \"curl*\",\n \"find*\",\n \"funzip*\",\n \"killall*\",\n \"openssl*\",\n \"screencapture*\",\n \"wget*\",\n)\n| rename columns.* as *\n| stats count min(_time) as firstTime\n max(_time) as lastTime\n values(cmdline) as cmdline\n values(pid) as pid\n values(parent) as parent\n values(path) as path\n values(signing_id) as signing_id\n dc(path) as dc_path\n BY username host\n\n| rename username as user\n cmdline as process\n path as process_path\n host as dest\n\n| where dc_path > 3\n| `security_content_ctime(firstTime)`\n| `security_content_ctime(lastTime)`\n| `macos_lolbin_filter`"
how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
known_false_positives: No false positives have been identified at this time.
references:
- https://osquery.readthedocs.io/en/stable/deployment/process-auditing/
drilldown_searches:
- name: View the detection results for - "$user$" and "$dest$"
search: '%original_detection_search% | search user = "$user$" dest = "$dest$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$user$" and "$dest$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: 7d
latest_offset: '0'
finding:
title: Multiplle LOLbin are executed on host $dest$ by user $user$
entity:
field: user
type: user
score: 50
intermediate_findings:
entities:
- field: dest
type: system
score: 50
message: Multiplle LOLbin are executed on host $dest$ by user $user$
analytic_story:
- Living Off The Land
- Hellcat Ransomware
- Axios Supply Chain Post Compromise
asset_type: Endpoint
mitre_attack_id:
- T1059.004
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
category: endpoint
security_domain: endpoint
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.004/macos_lolbin/osquery.log
source: osquery
sourcetype: osquery:results
test_type: unit
Stages and Predicates
Stage 1: search
`osquery_macro`
name=es_process_events
columns.cmdline IN (
"chmod*",
"crontab*",
"curl*",
"find*",
"funzip*",
"killall*",
"openssl*",
"screencapture*",
"wget*",
)
Stage 2: rename
| rename columns.* as *
Stage 3: stats
| stats count min(_time) as firstTime
max(_time) as lastTime
values(cmdline) as cmdline
values(pid) as pid
values(parent) as parent
values(path) as path
values(signing_id) as signing_id
dc(path) as dc_path
BY username host
Stage 4: rename
| rename username as user
cmdline as process
path as process_path
host as dest
Stage 5: where
| where dc_path > 3
Stage 6: search
| `security_content_ctime(firstTime)`
Stage 7: search
| `security_content_ctime(lastTime)`
Stage 8: search
| `macos_lolbin_filter`
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
columns.cmdline | in |
|
dc_path | gt |
|
name | eq |
|
sourcetype | eq |
|