ID | Technique | Tactic |
---|---|---|
T1647 | Plist File Modification | Defense Evasion |
Detection: MacOS plutil
Description
The following analytic detects the usage of the plutil
command to modify plist files on macOS systems. It leverages osquery to monitor process events, specifically looking for executions of /usr/bin/plutil
. This activity is significant because adversaries can use plutil
to alter plist files, potentially adding malicious binaries or command-line arguments that execute upon user logon or system startup. If confirmed malicious, this could allow attackers to achieve persistence, execute arbitrary code, or escalate privileges, posing a significant threat to the system's security.
Search
1`osquery_macro` name=es_process_events columns.path=/usr/bin/plutil
2| rename columns.* as *
3| stats count min(_time) as firstTime max(_time) as lastTime by username host cmdline pid path parent signing_id
4| rename username as user, cmdline as process, path as process_path, host as dest
5| `security_content_ctime(firstTime)`
6| `security_content_ctime(lastTime)`
7| `macos_plutil_filter`
Data Source
Name | Platform | Sourcetype | Source |
---|---|---|---|
osquery | N/A | 'osquery:results' |
'osquery' |
Macros Used
Name | Value |
---|---|
osquery_macro | sourcetype=osquery:results |
macos_plutil_filter | search * |
macos_plutil_filter
is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Annotations
Default Configuration
This detection is configured by default in Splunk Enterprise Security to run with the following settings:
Setting | Value |
---|---|
Disabled | true |
Cron Schedule | 0 * * * * |
Earliest Time | -70m@m |
Latest Time | -10m@m |
Schedule Window | auto |
Creates Notable | Yes |
Rule Title | %name% |
Rule Description | %description% |
Notable Event Fields | user, dest |
Creates Risk Event | True |
Implementation
This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
Known False Positives
Administrators using plutil to change plist files.
Associated Analytic Story
Risk Based Analytics (RBA)
Risk Message | Risk Score | Impact | Confidence |
---|---|---|---|
plutil are executed on $dest$ from $user$ | 25 | 50 | 50 |
References
Detection Testing
Test Type | Status | Dataset | Source | Sourcetype |
---|---|---|---|---|
Validation | ✅ Passing | N/A | N/A | N/A |
Unit | ✅ Passing | Dataset | osquery |
osquery:results |
Integration | ✅ Passing | Dataset | osquery |
osquery:results |
Replay any dataset to Splunk Enterprise by using our replay.py
tool or the UI.
Alternatively you can replay a dataset into a Splunk Attack Range
Source: GitHub | Version: 5