Fix macos category

stboissdev · Nov 11, 2021 · 735e5ea · 735e5ea
1 parent 8b419b8
commit 735e5ea
Show file tree

Hide file tree

Showing 29 changed files with 6 additions and 5 deletions.
diff --git a/...linux/macos/macos_emond_launch_daemon.yml → .../file_event/macos_emond_launch_daemon.yml b/...linux/macos/macos_emond_launch_daemon.yml → .../file_event/macos_emond_launch_daemon.yml
diff --git a/rules/linux/macos/macos_startup_items.yml → .../macos/file_event/macos_startup_items.yml b/rules/linux/macos/macos_startup_items.yml → .../macos/file_event/macos_startup_items.yml
diff --git a/rules/linux/macos/macos_applescript.yml → ...os/process_creation/macos_applescript.yml b/rules/linux/macos/macos_applescript.yml → ...os/process_creation/macos_applescript.yml
diff --git a/rules/linux/macos/macos_base64_decode.yml → .../process_creation/macos_base64_decode.yml b/rules/linux/macos/macos_base64_decode.yml → .../process_creation/macos_base64_decode.yml
diff --git a/rules/linux/macos/macos_binary_padding.yml → ...process_creation/macos_binary_padding.yml b/rules/linux/macos/macos_binary_padding.yml → ...process_creation/macos_binary_padding.yml
diff --git a/...nux/macos/macos_change_file_time_attr.yml → ..._creation/macos_change_file_time_attr.yml b/...nux/macos/macos_change_file_time_attr.yml → ..._creation/macos_change_file_time_attr.yml
diff --git a/...s/linux/macos/macos_clear_system_logs.yml → ...cess_creation/macos_clear_system_logs.yml b/...s/linux/macos/macos_clear_system_logs.yml → ...cess_creation/macos_clear_system_logs.yml
@@ -4,7 +4,7 @@ status: experimental
 description: Detects deletion of local audit logs
 author: remotephone, oscd.community
 date: 2020/10/11
-modified: 2021/08/14
+modified: 2021/11/11
 references:
     - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.002/T1070.002.md
 logsource:
@@ -16,7 +16,7 @@ detection:
     selection2:
         CommandLine|contains: '/var/log'
     selection3:
-        Commandline|contains|all:
+        CommandLine|contains|all:
             - '/Users/'
             - '/Library/Logs/'
     condition: selection1 and (selection2 or selection3)

diff --git a/rules/linux/macos/macos_create_account.yml → ...process_creation/macos_create_account.yml b/rules/linux/macos/macos_create_account.yml → ...process_creation/macos_create_account.yml
diff --git a/...nux/macos/macos_create_hidden_account.yml → ..._creation/macos_create_hidden_account.yml b/...nux/macos/macos_create_hidden_account.yml → ..._creation/macos_create_hidden_account.yml
diff --git a/...linux/macos/macos_creds_from_keychain.yml → ...ss_creation/macos_creds_from_keychain.yml b/...linux/macos/macos_creds_from_keychain.yml → ...ss_creation/macos_creds_from_keychain.yml
diff --git a/...ux/macos/macos_disable_security_tools.yml → ...creation/macos_disable_security_tools.yml b/...ux/macos/macos_disable_security_tools.yml → ...creation/macos_disable_security_tools.yml
diff --git a/...os/macos_file_and_directory_discovery.yml → ...on/macos_file_and_directory_discovery.yml b/...os/macos_file_and_directory_discovery.yml → ...on/macos_file_and_directory_discovery.yml
diff --git a/.../linux/macos/macos_find_cred_in_files.yml → ...ess_creation/macos_find_cred_in_files.yml b/.../linux/macos/macos_find_cred_in_files.yml → ...ess_creation/macos_find_cred_in_files.yml
diff --git a/...s/linux/macos/macos_gui_input_capture.yml → ...cess_creation/macos_gui_input_capture.yml b/...s/linux/macos/macos_gui_input_capture.yml → ...cess_creation/macos_gui_input_capture.yml
@@ -4,6 +4,7 @@ status: experimental
 description: Detects attempts to use system dialog prompts to capture user credentials
 author: remotephone, oscd.community
 date: 2020/10/13
+modified: 2021/11/11
 references:
     - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1056.002/T1056.002.md
     - https://scriptingosx.com/2018/08/user-interaction-from-bash-scripts/
@@ -15,13 +16,13 @@ detection:
         Image:
             - '/usr/sbin/osascript'
     selection2:
-        Commandline|contains|all:
+        CommandLine|contains|all:
             - '-e'
             - 'display'
             - 'dialog'
             - 'answer'
     selection3:
-        Commandline|contains:
+        CommandLine|contains:
             - 'admin'
             - 'administrator'
             - 'authenticate'

diff --git a/rules/linux/macos/macos_local_account.yml → .../process_creation/macos_local_account.yml b/rules/linux/macos/macos_local_account.yml → .../process_creation/macos_local_account.yml
diff --git a/rules/linux/macos/macos_local_groups.yml → ...s/process_creation/macos_local_groups.yml b/rules/linux/macos/macos_local_groups.yml → ...s/process_creation/macos_local_groups.yml
diff --git a/.../macos/macos_network_service_scanning.yml → ...eation/macos_network_service_scanning.yml b/.../macos/macos_network_service_scanning.yml → ...eation/macos_network_service_scanning.yml
diff --git a/rules/linux/macos/macos_network_sniffing.yml → ...ocess_creation/macos_network_sniffing.yml b/rules/linux/macos/macos_network_sniffing.yml → ...ocess_creation/macos_network_sniffing.yml
diff --git a/...x/macos/macos_remote_system_discovery.yml → ...reation/macos_remote_system_discovery.yml b/...x/macos/macos_remote_system_discovery.yml → ...reation/macos_remote_system_discovery.yml
diff --git a/...ux/macos/macos_schedule_task_job_cron.yml → ...creation/macos_schedule_task_job_cron.yml b/...ux/macos/macos_schedule_task_job_cron.yml → ...creation/macos_schedule_task_job_cron.yml
diff --git a/rules/linux/macos/macos_screencapture.yml → .../process_creation/macos_screencapture.yml b/rules/linux/macos/macos_screencapture.yml → .../process_creation/macos_screencapture.yml
diff --git a/...cos/macos_security_software_discovery.yml → ...ion/macos_security_software_discovery.yml b/...cos/macos_security_software_discovery.yml → ...ion/macos_security_software_discovery.yml
diff --git a/...ux/macos/macos_split_file_into_pieces.yml → ...creation/macos_split_file_into_pieces.yml b/...ux/macos/macos_split_file_into_pieces.yml → ...creation/macos_split_file_into_pieces.yml
diff --git a/.../macos/macos_susp_histfile_operations.yml → ...eation/macos_susp_histfile_operations.yml b/.../macos/macos_susp_histfile_operations.yml → ...eation/macos_susp_histfile_operations.yml
diff --git a/...os_suspicious_macos_firmware_activity.yml → ...os_suspicious_macos_firmware_activity.yml b/...os_suspicious_macos_firmware_activity.yml → ...os_suspicious_macos_firmware_activity.yml
diff --git a/..._system_network_connections_discovery.yml → ..._system_network_connections_discovery.yml b/..._system_network_connections_discovery.yml → ..._system_network_connections_discovery.yml
diff --git a/.../macos/macos_system_network_discovery.yml → ...eation/macos_system_network_discovery.yml b/.../macos/macos_system_network_discovery.yml → ...eation/macos_system_network_discovery.yml
@@ -20,7 +20,7 @@ detection:
             - '/usr/sbin/arp'
     selection2:
         Image: '/usr/bin/defaults'
-        Commandline|contains|all:
+        CommandLine|contains|all:
             - 'read'
             - '/Library/Preferences/com.apple.alf'
     condition: selection1 or selection2

diff --git a/...ux/macos/macos_system_shutdown_reboot.yml → ...creation/macos_system_shutdown_reboot.yml b/...ux/macos/macos_system_shutdown_reboot.yml → ...creation/macos_system_shutdown_reboot.yml
diff --git a/...x/macos/macos_xattr_gatekeeper_bypass.yml → ...reation/macos_xattr_gatekeeper_bypass.yml b/...x/macos/macos_xattr_gatekeeper_bypass.yml → ...reation/macos_xattr_gatekeeper_bypass.yml