Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4 detections
Filters
Last updated
All Time
Detection languages
2
1
1
Contributors
2
2
Categories
3
1
1
1
Platforms
4
Products / Services
1
1
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
IDS Classtypes
1
IDS Protocols
1
Detects creation of Emond rules for macOS event monitor persistence
This rule detects the creation of an Emond rule on macOS systems, which can be used for persistence. It specifically looks for network traffic containing the string "/etc/emond.d/" in a TCP flow to a server on port 22 (SSH). This indicates an attempt to establish or modify an Emond rule, which allows for scheduled execution of commands or scripts.
Detects additions or modifications to Emond Launch Daemon rule files or client directories, which adversaries may use to gain persistence and elevate privileges on macOS systems. This rule specifically looks for new or changed files in '/etc/emond.d/rules/' (plist files) or '/private/var/db/emondClients/'.
Detects additions to the Emond Launch Daemon that adversaries may use to gain persistence and elevate privileges.