diff --git a/filters/audits/macos.md b/filters/audits/macos.md new file mode 100644 index 000000000..d5bbaf11d --- /dev/null +++ b/filters/audits/macos.md @@ -0,0 +1,139 @@ +# macOS normalization and correlation review + +This draft targets UTMStack `v11` and changes both macOS filter configurations +and all 36 macOS rules. The pinned `go-sdk v1.1.31` Event/Side protobuf is the +schema authority. The local dictionary is supporting material. + +## Producer and consumer corrections + +The 30 sampled native raw records contain JSON with `message`, `process`, +`class_name`, `level`, `timestamp`, and identifiers whose names contain underscores. +The Go agent source supplies the dataType/dataSource envelope and forwards lines +from an external collector; the collector implementation was not available in +the inspected source tree. Its JSON shape is established by observed records, +while Apple documentation establishes class and level semantics. SDK JSON field +sanitization removes underscores and preserves letter case. The existing filter +already produces `log.message`; 35 rules instead read `log.eventMessage`. Those +rules now read the emitted message. The filter copies the process name to +`origin.process`, the raw timestamp to `deviceTime`, and meaningful agent +`dataSource` to `origin.host`. Every native record gets `dataSource` from the +agent hostname; the native producer uses `unknown` if hostname lookup fails. + +Legacy `eventMessage` and `messageType` remain available while supplying +`log.message` and `log.level` when the native fields are absent. Native values +win if both forms exist. `class_name` becomes the compatible `log.className` +alias; the original sanitized `log.classname` remains available. The four +existing activity/process/store/thread identifier aliases remain unchanged. +There is no PID field in the SDK Side message, so the numeric process identifier +stays in `log.processIdentifier`. No non-schema `origin.pid` is introduced. + +Apple documents `OSLogEntryLog` as an entry generated by the logging API. Three +class-gated rules accept this native class alongside their legacy `eventType` +checks; the filter does not invent `eventType`. Keychain and Endpoint Security +consume `log.level`. Apple debug, info/notice, error, and fault map respectively +to standard severity debug, info, error, and critical; undefined remains unmapped. +Vendor levels remain intact. A log level does not establish operation success, +so the filter does not synthesize `actionResult`. + +A native process string identifies the process name, not an executable path. +Only an explicitly supplied legacy `processImagePath` is copied to `origin.path`, +with its vendor alias preserved. Neither process nor sender is fabricated into +a path. All 36 rules retain `adversary: origin`; the host/process promotions feed +those existing actor roles. Host grouping now has an actual source identity; +process grouping uses `adversary.process`. Optional user grouping remains empty +when the producer has no user. Existing message grouping uses `lastEvent.log.message`. + +## Wrappers and history + +The optional forwarding prefix is anchored at the start of raw input. It first +captures `log.datasourceoverride`, then promotes only a nonempty, whitespace-free +value other than `unknown` to `dataSource`. Invalid overrides stay in their +vendor field without replacing ingress identity. JSON `datasource_override` +uses the same sanitized spelling and validation. The native filter handles the +wrapper itself and both filter execution orders are tested. Wrapper and legacy +message copies preserve newlines. The compatibility filter skips extraction +when a message is already available, avoiding duplicate capture. The original +noise-drop policy runs after JSON extraction and legacy level normalization, +before the remaining normalization work. + +Endpoint Security and ransomware history searches use the meaningful per-agent +`dataSource` and an exact candidate marker computed by the filter. Without that +marker, any earlier macOS event from the same source could satisfy a security +threshold. Marker conditions repeat the complete rule trigger; tests check their +parity. Untrusted incoming markers are removed and recomputed. The rules retain +their existing counts/windows and reject empty/unknown identities. Filter and +rules must deploy together; old indexed events do not have candidate markers, +so each history window must warm up after deployment. + +The kernel-extension rule no longer treats a missing or non-system executable +path as evidence that the loaded extension is untrusted. Its first branch +requires explicit unsigned or invalid-signature message evidence. Process +exclusions in kernel-extension, XProtect and TCC checks require a present process +name. The other negative predicates were checked for positive same-field gates. + +## Validation and bounded evidence + +- Standalone `macos_contract_test.go` tests 99 synthetic raw fixtures in three + configurations: native filter alone, compatibility filter first, and + compatibility filter last. This includes a native positive and benign negative + for each of the 36 rules, wrapper edge cases, multiline/legacy messages, + severity/identity mappings, noise drops and absent-field regressions. +- All 36 real SDK CEL predicates are compiled/evaluated. Forty-two positive + fixtures assert intended matches, source grouping identities, and available + history placeholders. The two candidate-marker predicates must agree with + their consumers. Negative fixtures assert that none of the 36 rules matches. +- Real SDK historical requests execute against a local mock OpenSearch service. + Both history rules are checked below/at count thresholds, against another + source, benign non-candidate history, and expired events. The mock test runs + in a subprocess because the SDK OpenSearch client is a process-wide singleton. +- The shared contract manifest covers 90 raw JSON cases with opt-in decoding and recursive + history-placeholder preflight supplied by draft #2590. The standalone macOS + tests also cover wrappers, which the shared harness deliberately does not model. +- Thirty distinct raw/normalized records from three instances were inspected + read-only. All use native JSON; all lack `log.eventMessage`, `origin.host` and + `origin.process`; all carry a raw timestamp differing from stored `deviceTime`. + The relevant deployed repository filters match the baseline mappings. Private + evidence retains instance/document anchors, raw records and configuration + hashes without publishing customer payloads. +- Replaying those 30 raw records through the offline parser model and actual SDK + CEL yields zero candidates. No wrapper override was observed in bounded + 30-day searches on those instances. Wrapper defects are supported by source, + deployed filter configuration and synthetic tests, not observed wrapper events. + +Filter extraction and transformations are an offline model using SDK field +sanitization and documented steps. Configuration decoding, CEL, Event conversion, +placeholder expansion, query construction and count decisions use the actual +SDK. This does not execute the closed EventProcessor or validate live alert +creation/delivery. No customer writes or production rollout were performed. + +## Activation and remaining validation + +Correcting 35 message consumers can materially increase alert candidates. +Populating host grouping can also consolidate events that previously had no +usable grouping identity. The bounded sample had no candidates; it does not +measure false-positive rates or establish detection coverage. Before rollout, +staging must compare actual raw/output/alert records and per-rule volumes, +identity grouping, time/count behavior, and expected benign traffic. + +Native samples do not include a process image path. Legacy branches comparing +that executable path to a TCC database or Gatekeeper resource path remain +semantically uncertain and unexercised by the native positive fixtures. No +resource path was invented as a process image to make those branches pass; +message-based branches supply the tested matches. Further producer evidence is +required before changing those resource-specific heuristics. + +The shared alert-grouping correction in draft #2590 is required for runtime +resolution of the remaining `lastEvent.*` grouping keys. Review and deploy the +filter, its consumers and that grouping support together. This draft does not +claim that existing heuristic matches prove malware or compromise. + +## References + +- [SDK schema v1.1.31](https://github.com/threatwinds/go-sdk/blob/v1.1.31/plugins/plugins.proto) +- [SDK sanitization](https://github.com/threatwinds/go-sdk/blob/v1.1.31/utils/fields.go) +- [Native macOS producer](https://github.com/utmstack/UTMStack/blob/v11/agent/collector/platform/darwin.go) +- [Filter steps](https://github.com/threatwinds/go-sdk/wiki/Filter-Steps-Reference) +- [Standard event schema](https://github.com/threatwinds/go-sdk/wiki/Standard-Event-Schema) +- [Correlation rules](https://github.com/threatwinds/go-sdk/wiki/Implementing-Rules) +- [Apple OSLogEntryLog](https://developer.apple.com/documentation/oslog/oslogentrylog) +- [Apple log entry levels](https://developer.apple.com/documentation/oslog/oslogentrylog/level-swift.enum) diff --git a/filters/macos/macos-syslog.yml b/filters/macos/macos-syslog.yml index 71ac66c8b..6abba050b 100644 --- a/filters/macos/macos-syslog.yml +++ b/filters/macos/macos-syslog.yml @@ -1,22 +1,29 @@ +# Compatibility wrapper extraction; macos.yml also handles this format. pipeline: - - dataTypes: - - macos + - dataTypes: [macos] steps: - # 1. Handle Agent Wrapper (Optional) + # Optional forwarding wrapper. Anchoring prevents payload text from + # overriding the source, and the message is captured exactly once. - grok: source: raw patterns: - - fieldName: log.wrapper_open - pattern: '\[utm_stack_agent_ds=' - - fieldName: log.datasource_override - pattern: '{{.data}}' - - fieldName: log.wrapper_close + - fieldName: '' + pattern: '^\[utm_stack_agent_ds=' + - fieldName: log.datasourceoverride + pattern: '[^\]\r\n]*' + - fieldName: '' pattern: '\]-' + - fieldName: log.wrapperMessage + pattern: '(?s:.*)' + where: startsWith("raw", "[utm_stack_agent_ds=") && !exists("log.message") + - json: + source: log.wrapperMessage + where: regexMatch("log.wrapperMessage", "^\\s*\\{") && !exists("log.message") + - grok: + source: log.wrapperMessage + patterns: - fieldName: log.message - pattern: '{{.greedy}}' - - fieldName: log.message - pattern: '{{.greedy}}' - - # 2. Cleanup + pattern: '(?s:.*)' + where: exists("log.wrapperMessage") && !regexMatch("log.wrapperMessage", "^\\s*\\{") && !exists("log.message") - delete: - fields: [log.wrapper_open, log.wrapper_close] + fields: [log.wrapperMessage] diff --git a/filters/macos/macos.yml b/filters/macos/macos.yml index 35eb41559..b50ff3ba3 100644 --- a/filters/macos/macos.yml +++ b/filters/macos/macos.yml @@ -1,32 +1,159 @@ -# Macos filter, version 3.0.1 +# macOS native JSON and forwarding-wrapper filter, version 3.1.0 pipeline: - - dataTypes: - - macos + - dataTypes: [macos] steps: + # Optional forwarding wrapper. Anchoring prevents payload text from + # overriding the source, and the message is captured exactly once. + - grok: + source: raw + patterns: + - fieldName: '' + pattern: '^\[utm_stack_agent_ds=' + - fieldName: log.datasourceoverride + pattern: '[^\]\r\n]*' + - fieldName: '' + pattern: '\]-' + - fieldName: log.wrapperMessage + pattern: '(?s:.*)' + where: startsWith("raw", "[utm_stack_agent_ds=") && !exists("log.message") - json: source: raw + where: regexMatch("raw", "^\\s*\\{") + - json: + source: log.wrapperMessage + where: regexMatch("log.wrapperMessage", "^\\s*\\{") + - grok: + source: log.wrapperMessage + patterns: + - fieldName: log.message + pattern: '(?s:.*)' + where: exists("log.wrapperMessage") && !regexMatch("log.wrapperMessage", "^\\s*\\{") + # Normalize the legacy level before applying the existing noise policy. + - grok: + source: log.messageType + patterns: + - fieldName: log.level + pattern: '(?s:.*)' + where: '!exists("log.level")' + # All fields used by the drop predicate are now available. + - drop: + where: equals("log.level", "notice") && contains("log.subsystem", "com.apple.cloudkit") || contains("log.subsystem", "com.apple.CoreDuet") || oneOf("log.subsystem", ["com.apple.apsd", "com.apple.bluetooth", "com.apple.SkyLight", "com.apple.mDNSResponder", "com.apple.homed", "com.apple.identityservicesd", "com.apple.powerlogd", "com.apple.analyticsd", "com.apple.UIKit", "com.apple.runningboard", "com.apple.WiFiManager", "com.apple.xpc", "com.apple.cache_delete", "com.apple.spotlightindex"]) - # Renaming useful fields - rename: - from: - - log.activityidentifier + from: [log.activityidentifier] to: log.activityIdentifier - - rename: - from: - - log.processidentifier + from: [log.processidentifier] to: log.processIdentifier - - rename: - from: - - log.storecategory + from: [log.storecategory] to: log.storeCategory - - rename: - from: - - log.threadidentifier + from: [log.threadidentifier] to: log.threadIdentifier + - grok: + source: log.classname + patterns: + - fieldName: log.className + pattern: '(?s:.*)' + where: '!exists("log.className")' + - grok: + source: log.eventMessage + patterns: + - fieldName: log.message + pattern: '(?s:.*)' + where: '!exists("log.message")' - # Drop unnecessary events - - drop: - where: equals("log.level", "notice") && contains("log.subsystem", "com.apple.cloudkit") || contains("log.subsystem", "com.apple.CoreDuet") || oneOf("log.subsystem", ["com.apple.apsd", "com.apple.bluetooth", "com.apple.SkyLight", "com.apple.mDNSResponder", "com.apple.homed", "com.apple.identityservicesd", "com.apple.powerlogd", "com.apple.analyticsd", "com.apple.UIKit", "com.apple.runningboard", "com.apple.WiFiManager", "com.apple.xpc", "com.apple.cache_delete", "com.apple.spotlightindex"]) \ No newline at end of file + # SDK JSON key sanitization removes the underscore in datasource_override. + - rename: + from: [log.datasourceoverride] + to: dataSource + where: regexMatch("log.datasourceoverride", "^[^\\s]+$") && !equals("log.datasourceoverride", "unknown") + - grok: + source: dataSource + patterns: + - fieldName: origin.host + pattern: '(?s:.*)' + where: '!oneOf("dataSource", ["", "unknown"])' + - grok: + source: log.process + patterns: + - fieldName: origin.process + pattern: '(?s:.*)' + where: exists("log.process") + - grok: + source: log.processImagePath + patterns: + - fieldName: origin.path + pattern: '(?s:.*)' + where: exists("log.processImagePath") + - grok: + source: log.timestamp + patterns: + - fieldName: deviceTime + pattern: '(?s:.*)' + where: regexMatch("log.timestamp", "^\\d{4}-\\d{2}-\\d{2}T") + - add: + function: string + params: + key: severity + value: debug + where: equals("log.level", "debug") + - add: + function: string + params: + key: severity + value: info + where: equals("log.level", "info") + - add: + function: string + params: + key: severity + value: info + where: equals("log.level", "notice") + - add: + function: string + params: + key: severity + value: error + where: equals("log.level", "error") + - add: + function: string + params: + key: severity + value: critical + where: equals("log.level", "fault") + + # Only matching security candidates may satisfy historical thresholds. + # The raw contract tests check parity against the two rule predicates. + - delete: + fields: [log.correlationCandidate, log.wrapperMessage] + - add: + function: string + params: + key: log.correlationCandidate.endpointSecurity + value: match + where: | + !oneOf("dataSource", ["", "unknown"]) && + (equals("log.subsystem", "com.apple.endpointsecurity") || + contains("origin.process", "EndpointSecurity") || + contains("log.message", "ES_EVENT_TYPE")) && + (contains("log.message", "bypass") || + contains("log.message", "failed authorization") || + contains("log.message", "client disconnected") || + contains("log.message", "authorization denied") || + contains("log.message", "invalid client") || + contains("log.message", "ES_RETURN_ERROR") || + equals("log.level", "error") || + contains("log.message", "memory leak detected")) + - add: + function: string + params: + key: log.correlationCandidate.ransomware + value: match + where: | + !oneOf("dataSource", ["", "unknown"]) && + ( (contains("log.message", ["encrypted", "encrypt", ".locked", ".crypto", ".crypt"]) || + regexMatch("log.message", "(?i)\\.(locky|cerber|wannacry|ryuk|maze|conti|lockbit)$")) && + (contains("log.message", "rename") || contains("log.message", "modified") || + contains("log.message", "write"))) diff --git a/plugins/alerts/macos_contract_test.go b/plugins/alerts/macos_contract_test.go new file mode 100644 index 000000000..91c9c312f --- /dev/null +++ b/plugins/alerts/macos_contract_test.go @@ -0,0 +1,655 @@ +package main + +// Offline macOS parser and correlation contracts. JSON key sanitization, +// rename/cast/grok/add/trim/delete are modeled from the documented pipeline; +// the closed EventProcessor is not executed. CEL, final Event conversion, +// placeholder resolution, query construction and threshold decisions use go-sdk. +// History searches reach only a local mock, never a customer instance. +import ( + "bytes" + "encoding/json" + "fmt" + "io" + "net/http" + "net/http/httptest" + "os" + "os/exec" + "path/filepath" + "reflect" + "regexp" + "strings" + "testing" + "time" + + sdkos "github.com/threatwinds/go-sdk/os" + + "text/template" + + "github.com/threatwinds/go-sdk/plugins" + "github.com/threatwinds/go-sdk/utils" + "github.com/tidwall/gjson" + "google.golang.org/protobuf/encoding/protojson" +) + +type macFixture struct { + Drop bool `json:"drop"` + Name string `json:"name"` + DataSource string `json:"dataSource"` + Raw string `json:"raw"` + Expected map[string]any `json:"expected"` + Absent []string `json:"absent"` + Matches []string `json:"matches"` +} + +func macPut(m map[string]any, path string, value any, remove bool) { + p := strings.Split(path, ".") + for _, k := range p[:len(p)-1] { + n, ok := m[k].(map[string]any) + if !ok { + if remove { + return + } + n = map[string]any{} + m[k] = n + } + m = n + } + if remove { + delete(m, p[len(p)-1]) + } else { + m[p[len(p)-1]] = value + } +} +func macGet(m map[string]any, p string) (any, bool) { + var v any = m + for _, k := range strings.Split(p, ".") { + n, ok := v.(map[string]any) + if !ok { + return nil, false + } + v, ok = n[k] + if !ok { + return nil, false + } + } + return v, true +} +func macConfig(t *testing.T) *plugins.Config { + t.Helper() + b, e := utils.ReadPbYaml("../../filters/macos/macos.yml") + if e != nil { + t.Fatal(e) + } + c := new(plugins.Config) + if e = protojson.Unmarshal(b, c); e != nil { + t.Fatal(e) + } + return c +} +func macRegex(t *testing.T, g *plugins.Grok, cfg *plugins.Config) *regexp.Regexp { + t.Helper() + var pattern strings.Builder + for i, p := range g.Patterns { + if p.FieldName != "" { + fmt.Fprintf(&pattern, "(?P%s)", i, p.Pattern) + } else { + pattern.WriteString("(?:" + p.Pattern + ")") + } + } + pats := map[string]string{"greedy": ".*"} + for k, v := range cfg.Patterns { + pats[k] = v + } + tmpl, e := template.New("grok").Option("missingkey=error").Parse(pattern.String()) + if e != nil { + t.Fatal(e) + } + var b bytes.Buffer + if e = tmpl.Execute(&b, pats); e != nil { + t.Fatal(e) + } + r, e := regexp.Compile(b.String()) + if e != nil { + t.Fatal(e) + } + return r +} +func macParse(t *testing.T, cfg *plugins.Config, raw string, dataSource string, cache *plugins.CELCache) string { + t.Helper() + draft := map[string]any{"raw": raw, "dataType": "macos", "dataSource": dataSource, "log": map[string]any{}} + for _, stage := range cfg.Pipeline { + for _, s := range stage.Steps { + b, e := protojson.Marshal(s) + if e != nil { + t.Fatal(e) + } + var step map[string]map[string]any + if e = json.Unmarshal(b, &step); e != nil { + t.Fatal(e) + } + for kind, body := range step { + if w, ok := body["where"].(string); ok && w != "" { + snapshot, err := json.Marshal(draft) + if err != nil { + t.Fatal(err) + } + match, e := cache.Eval(w, string(snapshot)) + if e != nil { + t.Fatal(e) + } + if !match { + continue + } + } + switch kind { + case "grok": + g := s.Grok + src := g.Source + if src == "" { + src = "raw" + } + v, ok := macGet(draft, src) + if !ok { + continue + } + str, ok := v.(string) + if !ok { + t.Fatalf("non-string grok source %s", src) + } + r := macRegex(t, g, cfg) + m := r.FindStringSubmatch(str) + if m == nil { + continue + } + for i, p := range g.Patterns { + if p.FieldName != "" { + macPut(draft, p.FieldName, m[r.SubexpIndex(fmt.Sprintf("f%d", i))], false) + } + } + case "rename": + for _, p := range s.Rename.From { + if v, ok := macGet(draft, p); ok { + macPut(draft, s.Rename.To, v, false) + macPut(draft, p, nil, true) + break + } + } + case "trim": + for _, p := range s.Trim.Fields { + if v, ok := macGet(draft, p); ok { + str, ok := v.(string) + if !ok { + continue + } + switch s.Trim.Function { + case "prefix": + str = strings.TrimPrefix(str, s.Trim.Substring) + case "suffix": + str = strings.TrimSuffix(str, s.Trim.Substring) + default: + t.Fatalf("unsupported trim %s", s.Trim.Function) + } + macPut(draft, p, str, false) + } + } + case "add": + macPut(draft, s.Add.Params["key"].GetStringValue(), s.Add.Params["value"].AsInterface(), false) + case "delete": + for _, p := range s.Delete.Fields { + macPut(draft, p, nil, true) + } + case "json": + source, ok := macGet(draft, s.Json.Source) + if !ok { + continue + } + str, ok := source.(string) + if !ok { + t.Fatalf("JSON source is not a string") + } + var parsed map[string]any + if e := json.Unmarshal([]byte(str), &parsed); e != nil { + t.Fatal(e) + } + for key, value := range macSanitizeJSON(parsed) { + macPut(draft, "log."+key, value, false) + } + case "cast": + for _, field := range s.Cast.Fields { + if value, ok := macGet(draft, field); ok { + switch s.Cast.To { + case "string": + macPut(draft, field, utils.CastString(value), false) + case "int": + macPut(draft, field, utils.CastInt64(value), false) + default: + t.Fatalf("unsupported cast %s", s.Cast.To) + } + } + } + case "drop": + return "" + default: + t.Fatalf("unsupported filter step %s", kind) + } + } + } + } + b, e := json.Marshal(draft) + if e != nil { + t.Fatal(e) + } + in := string(b) + ev := new(plugins.Event) + if e = utils.StringToProtoMessage(&in, ev); e != nil { + t.Fatal(e) + } + out, e := utils.ProtoMessageToString(ev) + if e != nil { + t.Fatal(e) + } + return *out +} +func macRules(t *testing.T) map[string]*plugins.Rule { + t.Helper() + paths, e := filepath.Glob("../../rules/macos/*.yml") + if e != nil { + t.Fatal(e) + } + out := map[string]*plugins.Rule{} + for _, p := range paths { + b, e := utils.ReadPbYaml(p) + if e != nil { + t.Fatal(e) + } + r := new(plugins.Rule) + if e = protojson.Unmarshal(b, r); e != nil { + t.Fatal(e) + } + r.Normalize() + out[strings.TrimSuffix(filepath.Base(p), ".yml")] = r + } + return out +} + +func macSanitizeJSON(input map[string]any) map[string]any { + out := map[string]any{} + for key, value := range input { + utils.SanitizeField(&key) + if nested, ok := value.(map[string]any); ok { + value = macSanitizeJSON(nested) + } + out[key] = value + } + return out +} + +func macFixtures(t *testing.T) []macFixture { + t.Helper() + b, e := os.ReadFile("testdata/macos_raw.json") + if e != nil { + t.Fatal(e) + } + var fixtures []macFixture + if e = json.Unmarshal(b, &fixtures); e != nil { + t.Fatal(e) + } + return fixtures +} + +func macCombined(t *testing.T, first string, second string) *plugins.Config { + t.Helper() + out := new(plugins.Config) + for _, name := range []string{first, second} { + if name == "" { + continue + } + b, e := utils.ReadPbYaml("../../filters/macos/" + name + ".yml") + if e != nil { + t.Fatal(e) + } + cfg := new(plugins.Config) + if e = protojson.Unmarshal(b, cfg); e != nil { + t.Fatal(e) + } + out.Pipeline = append(out.Pipeline, cfg.Pipeline...) + } + return out +} +func macMarker(name string) string { + if name == "endpoint_security_bypass" { + return "log.correlationCandidate.endpointSecurity" + } + if name == "macos_ransomware_indicators" { + return "log.correlationCandidate.ransomware" + } + return "" +} +func TestMacOSRawContracts(t *testing.T) { + rules, cache := macRules(t), plugins.NewCELCache("macos-raw") + configs := map[string]*plugins.Config{"main": macConfig(t), "wrapper-first": macCombined(t, "macos-syslog", "macos"), "wrapper-last": macCombined(t, "macos", "macos-syslog")} + for order, cfg := range configs { + for _, f := range macFixtures(t) { + t.Run(order+"/"+f.Name, func(t *testing.T) { + out := macParse(t, cfg, f.Raw, f.DataSource, cache) + if f.Drop { + if out != "" { + t.Fatal("noise event was not dropped") + } + return + } + if out == "" { + t.Fatal("event unexpectedly dropped") + } + for field, want := range f.Expected { + got := gjson.Get(out, field) + if !got.Exists() || !reflect.DeepEqual(got.Value(), want) { + t.Errorf("%s got %v want %v", field, got.Value(), want) + } + } + for _, field := range f.Absent { + if gjson.Get(out, field).Exists() { + t.Errorf("unexpected %s", field) + } + } + if gjson.Get(out, "raw").String() != f.Raw { + t.Error("raw changed") + } + expected := map[string]bool{} + for _, name := range f.Matches { + expected[name] = true + } + for name, r := range rules { + yes, e := cache.Eval(r.Where, out) + if e != nil { + t.Fatalf("%s CEL error: %v", name, e) + } + if expected[name] && !yes { + t.Errorf("%s did not match", name) + } + if expected[name] && yes { + macCheckGrouping(t, r, out) + } + if len(f.Matches) == 0 && yes { + t.Errorf("negative fixture matched %s", name) + } + if marker := macMarker(name); marker != "" { + present := gjson.Get(out, marker).String() == "match" + if present != yes { + t.Errorf("%s marker/predicate mismatch", name) + } + } + if yes { + for _, search := range r.Correlation { + for _, term := range search.With { + v := term.Value.GetStringValue() + if strings.HasPrefix(v, "{{.") { + field := strings.TrimSuffix(strings.TrimPrefix(v, "{{."), "}}") + if !gjson.Get(out, field).Exists() { + t.Errorf("%s unresolved %s", name, field) + } + } + } + } + } + } + }) + } + } +} + +// Verify the source contract for grouping using the documented origin-to- +// adversary role. lastEvent is an indexed alias of the final wire event; its +// runtime resolution is covered by the shared alert-grouping tests. +func macCheckGrouping(t *testing.T, rule *plugins.Rule, eventJSON string) { + t.Helper() + if rule.Adversary != "origin" { + t.Fatalf("unexpected macOS actor role %s", rule.Adversary) + } + event := new(plugins.Event) + if e := utils.StringToProtoMessage(&eventJSON, event); e != nil { + t.Fatal(e) + } + alert := &plugins.Alert{Adversary: event.Origin, Events: []*plugins.Event{event}} + wire, e := utils.ProtoMessageToString(alert) + if e != nil { + t.Fatal(e) + } + hasIdentity := false + for _, field := range rule.GroupBy { + path := strings.Replace(field, "lastEvent.", "events.0.", 1) + value := gjson.Get(*wire, path) + if field == "adversary.host" || field == "lastEvent.dataSource" { + if value.String() != event.DataSource || value.String() == "" || value.String() == "unknown" { + t.Errorf("%s has no usable grouping identity %s", rule.Name, field) + } + hasIdentity = true + } + if field == "adversary.process" && event.GetOrigin().GetProcess() != "" && value.String() != event.GetOrigin().GetProcess() { + t.Errorf("%s process grouping lost its actor", rule.Name) + } + if field == "lastEvent.log.message" && value.String() != gjson.Get(eventJSON, "log.message").String() { + t.Errorf("%s message grouping lost its message", rule.Name) + } + } + if !hasIdentity { + t.Errorf("%s grouping lacks a source identity", rule.Name) + } +} + +func TestMacOSSDKHistory(t *testing.T) { + // The SDK owns a process-wide OpenSearch singleton. Isolate this local mock + // so other technology tests can initialize their own clients in this suite. + if os.Getenv("UTM_MACOS_HISTORY_CHILD") != "1" { + command := exec.Command(os.Args[0], "-test.run=^TestMacOSSDKHistory$") + command.Env = append(os.Environ(), "UTM_MACOS_HISTORY_CHILD=1") + if out, e := command.CombinedOutput(); e != nil { + t.Fatalf("isolated history test: %v\n%s", e, out) + } + return + } + + cfg, rules, cache := macConfig(t), macRules(t), plugins.NewCELCache("macos-history") + var history []string + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + w.Header().Set("Content-Type", "application/json") + if strings.HasSuffix(r.URL.Path, "/_mapping") { + _, _ = w.Write([]byte(`{"v11-log-macos-test":{"mappings":{"properties":{"@timestamp":{"type":"date"},"dataSource":{"type":"text","fields":{"keyword":{"type":"keyword"}}},"log":{"properties":{"correlationCandidate":{"properties":{"endpointSecurity":{"type":"keyword"},"ransomware":{"type":"keyword"}}}}}}}}}`)) + return + } + if r.URL.Path != "/v11-log-macos-*/_search" { + t.Errorf("unexpected path %s", r.URL.Path) + } + b, e := io.ReadAll(r.Body) + if e != nil { + t.Error(e) + } + query := string(b) + clauses := append(gjson.Get(query, "query.bool.must").Array(), gjson.Get(query, "query.bool.filter").Array()...) + if len(clauses) != 3 { + t.Errorf("missing history clauses: %s", query) + } + hits := []map[string]any{} + for _, doc := range history { + yes := true + for _, clause := range clauses { + if term := clause.Get("term"); term.Exists() { + for field, v := range term.Map() { + if gjson.Get(doc, strings.TrimSuffix(field, ".keyword")).String() != v.Get("value").String() { + yes = false + } + } + } else if span := clause.Get("range"); span.Exists() { + for field, limits := range span.Map() { + stamp, e := time.Parse(time.RFC3339Nano, gjson.Get(doc, field).String()) + if e != nil { + t.Error(e) + } + cutoff, e := time.Parse(time.RFC3339Nano, limits.Get("gte").String()) + if e != nil { + t.Error(e) + } + if stamp.Before(cutoff) { + yes = false + } + } + } else { + t.Errorf("unsupported clause %s", clause.Raw) + } + } + if yes { + hits = append(hits, map[string]any{"_id": fmt.Sprint(len(hits)), "_index": "v11-log-macos-test", "_source": map[string]any{}}) + } + } + _ = json.NewEncoder(w).Encode(map[string]any{"took": 1, "hits": map[string]any{"total": map[string]any{"value": len(hits), "relation": "eq"}, "hits": hits}}) + })) + defer server.Close() + if e := sdkos.Connect([]string{server.URL}, "", ""); e != nil { + t.Fatal(e) + } + mutate := func(doc, field string, value any) string { + var m map[string]any + if e := json.Unmarshal([]byte(doc), &m); e != nil { + t.Fatal(e) + } + macPut(m, field, value, value == nil) + b, e := json.Marshal(m) + if e != nil { + t.Fatal(e) + } + return string(b) + } + for _, f := range macFixtures(t) { + if f.Name != "endpoint_security_bypass native positive" && f.Name != "macos_ransomware_indicators native positive" { + continue + } + t.Run(f.Name, func(t *testing.T) { + out := macParse(t, cfg, f.Raw, f.DataSource, cache) + name := f.Matches[0] + search := rules[name].Correlation[0] + prior := mutate(out, "@timestamp", time.Now().Add(-time.Minute).UTC().Format(time.RFC3339Nano)) + history = nil + for i := uint64(0); i < search.Count-1; i++ { + history = append(history, prior) + } + yes, _, e := search.Execute(&out) + if e != nil || yes { + t.Fatalf("below threshold: %v %v", yes, e) + } + history = append(history, prior) + yes, _, e = search.Execute(&out) + if e != nil || !yes { + t.Fatalf("at threshold: %v %v", yes, e) + } + for _, change := range []struct { + field string + value any + }{{"dataSource", "other-mac"}, {macMarker(name), nil}, {"@timestamp", time.Now().Add(-time.Hour).UTC().Format(time.RFC3339Nano)}} { + history = nil + for i := uint64(0); i < search.Count; i++ { + history = append(history, mutate(prior, change.field, change.value)) + } + yes, _, e = search.Execute(&out) + if e != nil || yes { + t.Errorf("wrong/benign/expired %s: %v %v", change.field, yes, e) + } + } + }) + } +} + +// Optional bounded customer evidence stays outside the repository. Only counts +// and field names are logged; this remains a projected parser/CEL replay. +func TestMacOSPrivateEvidence(t *testing.T) { + dir := os.Getenv("UTM_MACOS_EVIDENCE") + if dir == "" { + t.Skip("set UTM_MACOS_EVIDENCE to bounded private evidence directory") + } + paths, e := filepath.Glob(filepath.Join(dir, "macos-*.json")) + if e != nil { + t.Fatal(e) + } + cfg, rules, cache := macConfig(t), macRules(t), plugins.NewCELCache("macos-private") + total := 0 + missing := map[string]int{} + matches := map[string]int{} + for _, path := range paths { + b, e := os.ReadFile(path) + if e != nil { + t.Fatal(e) + } + var doc map[string]any + if e = json.Unmarshal(b, &doc); e != nil { + t.Fatal(e) + } + seen := map[string]bool{} + var visit func(any) + visit = func(value any) { + switch value := value.(type) { + case map[string]any: + if src, ok := value["_source"].(map[string]any); ok { + id, _ := value["_id"].(string) + if seen[id] { + return + } + seen[id] = true + raw, _ := src["raw"].(string) + source, _ := src["dataSource"].(string) + out := macParse(t, cfg, raw, source, cache) + if out == "" { + t.Errorf("%s unexpectedly dropped", id) + return + } + stored, e := json.Marshal(src) + if e != nil { + t.Fatal(e) + } + total++ + for rawField, standard := range map[string]string{"timestamp": "deviceTime", "process": "origin.process", "message": "log.message"} { + want := gjson.Get(raw, rawField) + if !want.Exists() { + continue + } + if gjson.Get(out, standard).String() != want.String() { + t.Errorf("%s incorrect projected %s", id, standard) + } + if gjson.GetBytes(stored, standard).String() != want.String() { + missing[standard]++ + } + } + if gjson.Get(out, "origin.host").String() != source { + t.Errorf("%s incorrect host", id) + } + if !gjson.GetBytes(stored, "origin.host").Exists() { + missing["origin.host"]++ + } + if !gjson.GetBytes(stored, "log.eventMessage").Exists() { + missing["log.eventMessage"]++ + } + for name, r := range rules { + yes, e := cache.Eval(r.Where, out) + if e != nil { + t.Errorf("%s %s CEL: %v", id, name, e) + } + if yes { + matches[name]++ + } + } + return + } + for _, v := range value { + visit(v) + } + case []any: + for _, v := range value { + visit(v) + } + } + } + visit(doc) + } + if total == 0 { + t.Fatal("no private evidence records") + } + t.Logf("private distinct records=%d stored mismatches/absences=%v projected CEL candidates=%v", total, missing, matches) +} diff --git a/plugins/alerts/testdata/filter-contracts/macos.json b/plugins/alerts/testdata/filter-contracts/macos.json new file mode 100644 index 000000000..25d4a6145 --- /dev/null +++ b/plugins/alerts/testdata/filter-contracts/macos.json @@ -0,0 +1,3450 @@ +{ + "technology": "macOS", + "filters": [ + "filters/macos/macos.yml", + "filters/macos/macos-syslog.yml" + ], + "rules": [ + "rules/macos/admin_group_addition.yml", + "rules/macos/apple_script_abuse.yml", + "rules/macos/browser_child_process_exploitation.yml", + "rules/macos/cron_job_persistence.yml", + "rules/macos/dylib_hijacking.yml", + "rules/macos/endpoint_security_bypass.yml", + "rules/macos/folder_action_scripts.yml", + "rules/macos/gatekeeper_bypass_attempts.yml", + "rules/macos/gatekeeper_xattr_bypass.yml", + "rules/macos/gui_input_capture.yml", + "rules/macos/hidden_user_creation.yml", + "rules/macos/jxa_in_memory_execution.yml", + "rules/macos/kernel_extension_loading.yml", + "rules/macos/keychain_access_violations.yml", + "rules/macos/keychain_credential_dumping.yml", + "rules/macos/keychain_dumping_cli.yml", + "rules/macos/launch_agent_daemon_persistence.yml", + "rules/macos/login_items_persistence.yml", + "rules/macos/macos_ransomware_indicators.yml", + "rules/macos/notarization_bypass_attempts.yml", + "rules/macos/office_macro_exploitation.yml", + "rules/macos/osascript_encoded_execution.yml", + "rules/macos/plistbuddy_persistence.yml", + "rules/macos/privacy_preferences_tampering.yml", + "rules/macos/root_account_enable.yml", + "rules/macos/security_tools_disabling.yml", + "rules/macos/shell_profile_modification.yml", + "rules/macos/ssh_key_theft.yml", + "rules/macos/sudo_caching_abuse.yml", + "rules/macos/system_integrity_protection_bypass.yml", + "rules/macos/system_log_clearing.yml", + "rules/macos/tcc_database_manipulation.yml", + "rules/macos/time_machine_backup_deletion.yml", + "rules/macos/wizardupdate_malware.yml", + "rules/macos/xcsset_malware.yml", + "rules/macos/xprotect_evasion.yml" + ], + "fixtures": [ + { + "name": "admin_group_addition native positive", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"dscl\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"dscl -append /Groups/admin GroupMembership audituser\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": { + "origin.host": "mac-lab", + "origin.process": "dscl", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "dscl -append /Groups/admin GroupMembership audituser", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "rules": { + "rules/macos/admin_group_addition.yml": true + }, + "checkHistoryPlaceholders": true + }, + { + "name": "admin_group_addition native negative", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"dscl\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": {}, + "absent": [], + "rules": { + "rules/macos/admin_group_addition.yml": false, + "rules/macos/apple_script_abuse.yml": false, + "rules/macos/browser_child_process_exploitation.yml": false, + "rules/macos/cron_job_persistence.yml": false, + "rules/macos/dylib_hijacking.yml": false, + "rules/macos/endpoint_security_bypass.yml": false, + "rules/macos/folder_action_scripts.yml": false, + "rules/macos/gatekeeper_bypass_attempts.yml": false, + "rules/macos/gatekeeper_xattr_bypass.yml": false, + "rules/macos/gui_input_capture.yml": false, + "rules/macos/hidden_user_creation.yml": false, + "rules/macos/jxa_in_memory_execution.yml": false, + "rules/macos/kernel_extension_loading.yml": false, + "rules/macos/keychain_access_violations.yml": false, + "rules/macos/keychain_credential_dumping.yml": false, + "rules/macos/keychain_dumping_cli.yml": false, + "rules/macos/launch_agent_daemon_persistence.yml": false, + "rules/macos/login_items_persistence.yml": false, + "rules/macos/macos_ransomware_indicators.yml": false, + "rules/macos/notarization_bypass_attempts.yml": false, + "rules/macos/office_macro_exploitation.yml": false, + "rules/macos/osascript_encoded_execution.yml": false, + "rules/macos/plistbuddy_persistence.yml": false, + "rules/macos/privacy_preferences_tampering.yml": false, + "rules/macos/root_account_enable.yml": false, + "rules/macos/security_tools_disabling.yml": false, + "rules/macos/shell_profile_modification.yml": false, + "rules/macos/ssh_key_theft.yml": false, + "rules/macos/sudo_caching_abuse.yml": false, + "rules/macos/system_integrity_protection_bypass.yml": false, + "rules/macos/system_log_clearing.yml": false, + "rules/macos/tcc_database_manipulation.yml": false, + "rules/macos/time_machine_backup_deletion.yml": false, + "rules/macos/wizardupdate_malware.yml": false, + "rules/macos/xcsset_malware.yml": false, + "rules/macos/xprotect_evasion.yml": false + }, + "checkHistoryPlaceholders": true + }, + { + "name": "apple_script_abuse native positive", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"osascript\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"tell application System Events to do shell script\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": { + "origin.host": "mac-lab", + "origin.process": "osascript", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "tell application System Events to do shell script", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "rules": { + "rules/macos/apple_script_abuse.yml": true + }, + "checkHistoryPlaceholders": true + }, + { + "name": "apple_script_abuse native negative", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"osascript\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": {}, + "absent": [], + "rules": { + "rules/macos/admin_group_addition.yml": false, + "rules/macos/apple_script_abuse.yml": false, + "rules/macos/browser_child_process_exploitation.yml": false, + "rules/macos/cron_job_persistence.yml": false, + "rules/macos/dylib_hijacking.yml": false, + "rules/macos/endpoint_security_bypass.yml": false, + "rules/macos/folder_action_scripts.yml": false, + "rules/macos/gatekeeper_bypass_attempts.yml": false, + "rules/macos/gatekeeper_xattr_bypass.yml": false, + "rules/macos/gui_input_capture.yml": false, + "rules/macos/hidden_user_creation.yml": false, + "rules/macos/jxa_in_memory_execution.yml": false, + "rules/macos/kernel_extension_loading.yml": false, + "rules/macos/keychain_access_violations.yml": false, + "rules/macos/keychain_credential_dumping.yml": false, + "rules/macos/keychain_dumping_cli.yml": false, + "rules/macos/launch_agent_daemon_persistence.yml": false, + "rules/macos/login_items_persistence.yml": false, + "rules/macos/macos_ransomware_indicators.yml": false, + "rules/macos/notarization_bypass_attempts.yml": false, + "rules/macos/office_macro_exploitation.yml": false, + "rules/macos/osascript_encoded_execution.yml": false, + "rules/macos/plistbuddy_persistence.yml": false, + "rules/macos/privacy_preferences_tampering.yml": false, + "rules/macos/root_account_enable.yml": false, + "rules/macos/security_tools_disabling.yml": false, + "rules/macos/shell_profile_modification.yml": false, + "rules/macos/ssh_key_theft.yml": false, + "rules/macos/sudo_caching_abuse.yml": false, + "rules/macos/system_integrity_protection_bypass.yml": false, + "rules/macos/system_log_clearing.yml": false, + "rules/macos/tcc_database_manipulation.yml": false, + "rules/macos/time_machine_backup_deletion.yml": false, + "rules/macos/wizardupdate_malware.yml": false, + "rules/macos/xcsset_malware.yml": false, + "rules/macos/xprotect_evasion.yml": false + }, + "checkHistoryPlaceholders": true + }, + { + "name": "browser_child_process_exploitation native positive", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"Safari\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"/Applications/Safari.app spawned child process /bin/bash\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": { + "origin.host": "mac-lab", + "origin.process": "Safari", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "/Applications/Safari.app spawned child process /bin/bash", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "rules": { + "rules/macos/browser_child_process_exploitation.yml": true + }, + "checkHistoryPlaceholders": true + }, + { + "name": "browser_child_process_exploitation native negative", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"Safari\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": {}, + "absent": [], + "rules": { + "rules/macos/admin_group_addition.yml": false, + "rules/macos/apple_script_abuse.yml": false, + "rules/macos/browser_child_process_exploitation.yml": false, + "rules/macos/cron_job_persistence.yml": false, + "rules/macos/dylib_hijacking.yml": false, + "rules/macos/endpoint_security_bypass.yml": false, + "rules/macos/folder_action_scripts.yml": false, + "rules/macos/gatekeeper_bypass_attempts.yml": false, + "rules/macos/gatekeeper_xattr_bypass.yml": false, + "rules/macos/gui_input_capture.yml": false, + "rules/macos/hidden_user_creation.yml": false, + "rules/macos/jxa_in_memory_execution.yml": false, + "rules/macos/kernel_extension_loading.yml": false, + "rules/macos/keychain_access_violations.yml": false, + "rules/macos/keychain_credential_dumping.yml": false, + "rules/macos/keychain_dumping_cli.yml": false, + "rules/macos/launch_agent_daemon_persistence.yml": false, + "rules/macos/login_items_persistence.yml": false, + "rules/macos/macos_ransomware_indicators.yml": false, + "rules/macos/notarization_bypass_attempts.yml": false, + "rules/macos/office_macro_exploitation.yml": false, + "rules/macos/osascript_encoded_execution.yml": false, + "rules/macos/plistbuddy_persistence.yml": false, + "rules/macos/privacy_preferences_tampering.yml": false, + "rules/macos/root_account_enable.yml": false, + "rules/macos/security_tools_disabling.yml": false, + "rules/macos/shell_profile_modification.yml": false, + "rules/macos/ssh_key_theft.yml": false, + "rules/macos/sudo_caching_abuse.yml": false, + "rules/macos/system_integrity_protection_bypass.yml": false, + "rules/macos/system_log_clearing.yml": false, + "rules/macos/tcc_database_manipulation.yml": false, + "rules/macos/time_machine_backup_deletion.yml": false, + "rules/macos/wizardupdate_malware.yml": false, + "rules/macos/xcsset_malware.yml": false, + "rules/macos/xprotect_evasion.yml": false + }, + "checkHistoryPlaceholders": true + }, + { + "name": "cron_job_persistence native positive", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"cron\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"crontab INSTALL\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": { + "origin.host": "mac-lab", + "origin.process": "cron", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "crontab INSTALL", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "rules": { + "rules/macos/cron_job_persistence.yml": true + }, + "checkHistoryPlaceholders": true + }, + { + "name": "cron_job_persistence native negative", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"cron\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": {}, + "absent": [], + "rules": { + "rules/macos/admin_group_addition.yml": false, + "rules/macos/apple_script_abuse.yml": false, + "rules/macos/browser_child_process_exploitation.yml": false, + "rules/macos/cron_job_persistence.yml": false, + "rules/macos/dylib_hijacking.yml": false, + "rules/macos/endpoint_security_bypass.yml": false, + "rules/macos/folder_action_scripts.yml": false, + "rules/macos/gatekeeper_bypass_attempts.yml": false, + "rules/macos/gatekeeper_xattr_bypass.yml": false, + "rules/macos/gui_input_capture.yml": false, + "rules/macos/hidden_user_creation.yml": false, + "rules/macos/jxa_in_memory_execution.yml": false, + "rules/macos/kernel_extension_loading.yml": false, + "rules/macos/keychain_access_violations.yml": false, + "rules/macos/keychain_credential_dumping.yml": false, + "rules/macos/keychain_dumping_cli.yml": false, + "rules/macos/launch_agent_daemon_persistence.yml": false, + "rules/macos/login_items_persistence.yml": false, + "rules/macos/macos_ransomware_indicators.yml": false, + "rules/macos/notarization_bypass_attempts.yml": false, + "rules/macos/office_macro_exploitation.yml": false, + "rules/macos/osascript_encoded_execution.yml": false, + "rules/macos/plistbuddy_persistence.yml": false, + "rules/macos/privacy_preferences_tampering.yml": false, + "rules/macos/root_account_enable.yml": false, + "rules/macos/security_tools_disabling.yml": false, + "rules/macos/shell_profile_modification.yml": false, + "rules/macos/ssh_key_theft.yml": false, + "rules/macos/sudo_caching_abuse.yml": false, + "rules/macos/system_integrity_protection_bypass.yml": false, + "rules/macos/system_log_clearing.yml": false, + "rules/macos/tcc_database_manipulation.yml": false, + "rules/macos/time_machine_backup_deletion.yml": false, + "rules/macos/wizardupdate_malware.yml": false, + "rules/macos/xcsset_malware.yml": false, + "rules/macos/xprotect_evasion.yml": false + }, + "checkHistoryPlaceholders": true + }, + { + "name": "dylib_hijacking native positive", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"loader\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"suspicious unsigned dylib load failed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": { + "origin.host": "mac-lab", + "origin.process": "loader", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "suspicious unsigned dylib load failed", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "rules": { + "rules/macos/dylib_hijacking.yml": true + }, + "checkHistoryPlaceholders": true + }, + { + "name": "dylib_hijacking native negative", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"loader\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": {}, + "absent": [], + "rules": { + "rules/macos/admin_group_addition.yml": false, + "rules/macos/apple_script_abuse.yml": false, + "rules/macos/browser_child_process_exploitation.yml": false, + "rules/macos/cron_job_persistence.yml": false, + "rules/macos/dylib_hijacking.yml": false, + "rules/macos/endpoint_security_bypass.yml": false, + "rules/macos/folder_action_scripts.yml": false, + "rules/macos/gatekeeper_bypass_attempts.yml": false, + "rules/macos/gatekeeper_xattr_bypass.yml": false, + "rules/macos/gui_input_capture.yml": false, + "rules/macos/hidden_user_creation.yml": false, + "rules/macos/jxa_in_memory_execution.yml": false, + "rules/macos/kernel_extension_loading.yml": false, + "rules/macos/keychain_access_violations.yml": false, + "rules/macos/keychain_credential_dumping.yml": false, + "rules/macos/keychain_dumping_cli.yml": false, + "rules/macos/launch_agent_daemon_persistence.yml": false, + "rules/macos/login_items_persistence.yml": false, + "rules/macos/macos_ransomware_indicators.yml": false, + "rules/macos/notarization_bypass_attempts.yml": false, + "rules/macos/office_macro_exploitation.yml": false, + "rules/macos/osascript_encoded_execution.yml": false, + "rules/macos/plistbuddy_persistence.yml": false, + "rules/macos/privacy_preferences_tampering.yml": false, + "rules/macos/root_account_enable.yml": false, + "rules/macos/security_tools_disabling.yml": false, + "rules/macos/shell_profile_modification.yml": false, + "rules/macos/ssh_key_theft.yml": false, + "rules/macos/sudo_caching_abuse.yml": false, + "rules/macos/system_integrity_protection_bypass.yml": false, + "rules/macos/system_log_clearing.yml": false, + "rules/macos/tcc_database_manipulation.yml": false, + "rules/macos/time_machine_backup_deletion.yml": false, + "rules/macos/wizardupdate_malware.yml": false, + "rules/macos/xcsset_malware.yml": false, + "rules/macos/xprotect_evasion.yml": false + }, + "checkHistoryPlaceholders": true + }, + { + "name": "endpoint_security_bypass native positive", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"EndpointSecurity\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"ES_EVENT_TYPE: authorization denied\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": { + "origin.host": "mac-lab", + "origin.process": "EndpointSecurity", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "ES_EVENT_TYPE: authorization denied", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "rules": { + "rules/macos/endpoint_security_bypass.yml": true + }, + "checkHistoryPlaceholders": true + }, + { + "name": "endpoint_security_bypass native negative", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"EndpointSecurity\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": {}, + "absent": [], + "rules": { + "rules/macos/admin_group_addition.yml": false, + "rules/macos/apple_script_abuse.yml": false, + "rules/macos/browser_child_process_exploitation.yml": false, + "rules/macos/cron_job_persistence.yml": false, + "rules/macos/dylib_hijacking.yml": false, + "rules/macos/endpoint_security_bypass.yml": false, + "rules/macos/folder_action_scripts.yml": false, + "rules/macos/gatekeeper_bypass_attempts.yml": false, + "rules/macos/gatekeeper_xattr_bypass.yml": false, + "rules/macos/gui_input_capture.yml": false, + "rules/macos/hidden_user_creation.yml": false, + "rules/macos/jxa_in_memory_execution.yml": false, + "rules/macos/kernel_extension_loading.yml": false, + "rules/macos/keychain_access_violations.yml": false, + "rules/macos/keychain_credential_dumping.yml": false, + "rules/macos/keychain_dumping_cli.yml": false, + "rules/macos/launch_agent_daemon_persistence.yml": false, + "rules/macos/login_items_persistence.yml": false, + "rules/macos/macos_ransomware_indicators.yml": false, + "rules/macos/notarization_bypass_attempts.yml": false, + "rules/macos/office_macro_exploitation.yml": false, + "rules/macos/osascript_encoded_execution.yml": false, + "rules/macos/plistbuddy_persistence.yml": false, + "rules/macos/privacy_preferences_tampering.yml": false, + "rules/macos/root_account_enable.yml": false, + "rules/macos/security_tools_disabling.yml": false, + "rules/macos/shell_profile_modification.yml": false, + "rules/macos/ssh_key_theft.yml": false, + "rules/macos/sudo_caching_abuse.yml": false, + "rules/macos/system_integrity_protection_bypass.yml": false, + "rules/macos/system_log_clearing.yml": false, + "rules/macos/tcc_database_manipulation.yml": false, + "rules/macos/time_machine_backup_deletion.yml": false, + "rules/macos/wizardupdate_malware.yml": false, + "rules/macos/xcsset_malware.yml": false, + "rules/macos/xprotect_evasion.yml": false + }, + "checkHistoryPlaceholders": true + }, + { + "name": "folder_action_scripts native positive", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"FolderActionsDispatcher\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Folder Action script added\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": { + "origin.host": "mac-lab", + "origin.process": "FolderActionsDispatcher", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "Folder Action script added", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "rules": { + "rules/macos/folder_action_scripts.yml": true + }, + "checkHistoryPlaceholders": true + }, + { + "name": "folder_action_scripts native negative", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"FolderActionsDispatcher\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": {}, + "absent": [], + "rules": { + "rules/macos/admin_group_addition.yml": false, + "rules/macos/apple_script_abuse.yml": false, + "rules/macos/browser_child_process_exploitation.yml": false, + "rules/macos/cron_job_persistence.yml": false, + "rules/macos/dylib_hijacking.yml": false, + "rules/macos/endpoint_security_bypass.yml": false, + "rules/macos/folder_action_scripts.yml": false, + "rules/macos/gatekeeper_bypass_attempts.yml": false, + "rules/macos/gatekeeper_xattr_bypass.yml": false, + "rules/macos/gui_input_capture.yml": false, + "rules/macos/hidden_user_creation.yml": false, + "rules/macos/jxa_in_memory_execution.yml": false, + "rules/macos/kernel_extension_loading.yml": false, + "rules/macos/keychain_access_violations.yml": false, + "rules/macos/keychain_credential_dumping.yml": false, + "rules/macos/keychain_dumping_cli.yml": false, + "rules/macos/launch_agent_daemon_persistence.yml": false, + "rules/macos/login_items_persistence.yml": false, + "rules/macos/macos_ransomware_indicators.yml": false, + "rules/macos/notarization_bypass_attempts.yml": false, + "rules/macos/office_macro_exploitation.yml": false, + "rules/macos/osascript_encoded_execution.yml": false, + "rules/macos/plistbuddy_persistence.yml": false, + "rules/macos/privacy_preferences_tampering.yml": false, + "rules/macos/root_account_enable.yml": false, + "rules/macos/security_tools_disabling.yml": false, + "rules/macos/shell_profile_modification.yml": false, + "rules/macos/ssh_key_theft.yml": false, + "rules/macos/sudo_caching_abuse.yml": false, + "rules/macos/system_integrity_protection_bypass.yml": false, + "rules/macos/system_log_clearing.yml": false, + "rules/macos/tcc_database_manipulation.yml": false, + "rules/macos/time_machine_backup_deletion.yml": false, + "rules/macos/wizardupdate_malware.yml": false, + "rules/macos/xcsset_malware.yml": false, + "rules/macos/xprotect_evasion.yml": false + }, + "checkHistoryPlaceholders": true + }, + { + "name": "gatekeeper_bypass_attempts native positive", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"syspolicyd\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"assessment bypass attempted\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": { + "origin.host": "mac-lab", + "origin.process": "syspolicyd", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "assessment bypass attempted", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "rules": { + "rules/macos/gatekeeper_bypass_attempts.yml": true + }, + "checkHistoryPlaceholders": true + }, + { + "name": "gatekeeper_bypass_attempts native negative", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"syspolicyd\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": {}, + "absent": [], + "rules": { + "rules/macos/admin_group_addition.yml": false, + "rules/macos/apple_script_abuse.yml": false, + "rules/macos/browser_child_process_exploitation.yml": false, + "rules/macos/cron_job_persistence.yml": false, + "rules/macos/dylib_hijacking.yml": false, + "rules/macos/endpoint_security_bypass.yml": false, + "rules/macos/folder_action_scripts.yml": false, + "rules/macos/gatekeeper_bypass_attempts.yml": false, + "rules/macos/gatekeeper_xattr_bypass.yml": false, + "rules/macos/gui_input_capture.yml": false, + "rules/macos/hidden_user_creation.yml": false, + "rules/macos/jxa_in_memory_execution.yml": false, + "rules/macos/kernel_extension_loading.yml": false, + "rules/macos/keychain_access_violations.yml": false, + "rules/macos/keychain_credential_dumping.yml": false, + "rules/macos/keychain_dumping_cli.yml": false, + "rules/macos/launch_agent_daemon_persistence.yml": false, + "rules/macos/login_items_persistence.yml": false, + "rules/macos/macos_ransomware_indicators.yml": false, + "rules/macos/notarization_bypass_attempts.yml": false, + "rules/macos/office_macro_exploitation.yml": false, + "rules/macos/osascript_encoded_execution.yml": false, + "rules/macos/plistbuddy_persistence.yml": false, + "rules/macos/privacy_preferences_tampering.yml": false, + "rules/macos/root_account_enable.yml": false, + "rules/macos/security_tools_disabling.yml": false, + "rules/macos/shell_profile_modification.yml": false, + "rules/macos/ssh_key_theft.yml": false, + "rules/macos/sudo_caching_abuse.yml": false, + "rules/macos/system_integrity_protection_bypass.yml": false, + "rules/macos/system_log_clearing.yml": false, + "rules/macos/tcc_database_manipulation.yml": false, + "rules/macos/time_machine_backup_deletion.yml": false, + "rules/macos/wizardupdate_malware.yml": false, + "rules/macos/xcsset_malware.yml": false, + "rules/macos/xprotect_evasion.yml": false + }, + "checkHistoryPlaceholders": true + }, + { + "name": "gatekeeper_xattr_bypass native positive", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"xattr\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"xattr -d com.apple.quarantine sample.app\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": { + "origin.host": "mac-lab", + "origin.process": "xattr", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "xattr -d com.apple.quarantine sample.app", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "rules": { + "rules/macos/gatekeeper_xattr_bypass.yml": true + }, + "checkHistoryPlaceholders": true + }, + { + "name": "gatekeeper_xattr_bypass native negative", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"xattr\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": {}, + "absent": [], + "rules": { + "rules/macos/admin_group_addition.yml": false, + "rules/macos/apple_script_abuse.yml": false, + "rules/macos/browser_child_process_exploitation.yml": false, + "rules/macos/cron_job_persistence.yml": false, + "rules/macos/dylib_hijacking.yml": false, + "rules/macos/endpoint_security_bypass.yml": false, + "rules/macos/folder_action_scripts.yml": false, + "rules/macos/gatekeeper_bypass_attempts.yml": false, + "rules/macos/gatekeeper_xattr_bypass.yml": false, + "rules/macos/gui_input_capture.yml": false, + "rules/macos/hidden_user_creation.yml": false, + "rules/macos/jxa_in_memory_execution.yml": false, + "rules/macos/kernel_extension_loading.yml": false, + "rules/macos/keychain_access_violations.yml": false, + "rules/macos/keychain_credential_dumping.yml": false, + "rules/macos/keychain_dumping_cli.yml": false, + "rules/macos/launch_agent_daemon_persistence.yml": false, + "rules/macos/login_items_persistence.yml": false, + "rules/macos/macos_ransomware_indicators.yml": false, + "rules/macos/notarization_bypass_attempts.yml": false, + "rules/macos/office_macro_exploitation.yml": false, + "rules/macos/osascript_encoded_execution.yml": false, + "rules/macos/plistbuddy_persistence.yml": false, + "rules/macos/privacy_preferences_tampering.yml": false, + "rules/macos/root_account_enable.yml": false, + "rules/macos/security_tools_disabling.yml": false, + "rules/macos/shell_profile_modification.yml": false, + "rules/macos/ssh_key_theft.yml": false, + "rules/macos/sudo_caching_abuse.yml": false, + "rules/macos/system_integrity_protection_bypass.yml": false, + "rules/macos/system_log_clearing.yml": false, + "rules/macos/tcc_database_manipulation.yml": false, + "rules/macos/time_machine_backup_deletion.yml": false, + "rules/macos/wizardupdate_malware.yml": false, + "rules/macos/xcsset_malware.yml": false, + "rules/macos/xprotect_evasion.yml": false + }, + "checkHistoryPlaceholders": true + }, + { + "name": "gui_input_capture native positive", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"osascript\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"display dialog password with hidden answer\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": { + "origin.host": "mac-lab", + "origin.process": "osascript", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "display dialog password with hidden answer", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "rules": { + "rules/macos/gui_input_capture.yml": true + }, + "checkHistoryPlaceholders": true + }, + { + "name": "gui_input_capture native negative", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"osascript\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": {}, + "absent": [], + "rules": { + "rules/macos/admin_group_addition.yml": false, + "rules/macos/apple_script_abuse.yml": false, + "rules/macos/browser_child_process_exploitation.yml": false, + "rules/macos/cron_job_persistence.yml": false, + "rules/macos/dylib_hijacking.yml": false, + "rules/macos/endpoint_security_bypass.yml": false, + "rules/macos/folder_action_scripts.yml": false, + "rules/macos/gatekeeper_bypass_attempts.yml": false, + "rules/macos/gatekeeper_xattr_bypass.yml": false, + "rules/macos/gui_input_capture.yml": false, + "rules/macos/hidden_user_creation.yml": false, + "rules/macos/jxa_in_memory_execution.yml": false, + "rules/macos/kernel_extension_loading.yml": false, + "rules/macos/keychain_access_violations.yml": false, + "rules/macos/keychain_credential_dumping.yml": false, + "rules/macos/keychain_dumping_cli.yml": false, + "rules/macos/launch_agent_daemon_persistence.yml": false, + "rules/macos/login_items_persistence.yml": false, + "rules/macos/macos_ransomware_indicators.yml": false, + "rules/macos/notarization_bypass_attempts.yml": false, + "rules/macos/office_macro_exploitation.yml": false, + "rules/macos/osascript_encoded_execution.yml": false, + "rules/macos/plistbuddy_persistence.yml": false, + "rules/macos/privacy_preferences_tampering.yml": false, + "rules/macos/root_account_enable.yml": false, + "rules/macos/security_tools_disabling.yml": false, + "rules/macos/shell_profile_modification.yml": false, + "rules/macos/ssh_key_theft.yml": false, + "rules/macos/sudo_caching_abuse.yml": false, + "rules/macos/system_integrity_protection_bypass.yml": false, + "rules/macos/system_log_clearing.yml": false, + "rules/macos/tcc_database_manipulation.yml": false, + "rules/macos/time_machine_backup_deletion.yml": false, + "rules/macos/wizardupdate_malware.yml": false, + "rules/macos/xcsset_malware.yml": false, + "rules/macos/xprotect_evasion.yml": false + }, + "checkHistoryPlaceholders": true + }, + { + "name": "hidden_user_creation native positive", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"dscl\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"dscl create /Users/hidden IsHidden 1\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": { + "origin.host": "mac-lab", + "origin.process": "dscl", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "dscl create /Users/hidden IsHidden 1", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "rules": { + "rules/macos/hidden_user_creation.yml": true + }, + "checkHistoryPlaceholders": true + }, + { + "name": "hidden_user_creation native negative", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"dscl\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": {}, + "absent": [], + "rules": { + "rules/macos/admin_group_addition.yml": false, + "rules/macos/apple_script_abuse.yml": false, + "rules/macos/browser_child_process_exploitation.yml": false, + "rules/macos/cron_job_persistence.yml": false, + "rules/macos/dylib_hijacking.yml": false, + "rules/macos/endpoint_security_bypass.yml": false, + "rules/macos/folder_action_scripts.yml": false, + "rules/macos/gatekeeper_bypass_attempts.yml": false, + "rules/macos/gatekeeper_xattr_bypass.yml": false, + "rules/macos/gui_input_capture.yml": false, + "rules/macos/hidden_user_creation.yml": false, + "rules/macos/jxa_in_memory_execution.yml": false, + "rules/macos/kernel_extension_loading.yml": false, + "rules/macos/keychain_access_violations.yml": false, + "rules/macos/keychain_credential_dumping.yml": false, + "rules/macos/keychain_dumping_cli.yml": false, + "rules/macos/launch_agent_daemon_persistence.yml": false, + "rules/macos/login_items_persistence.yml": false, + "rules/macos/macos_ransomware_indicators.yml": false, + "rules/macos/notarization_bypass_attempts.yml": false, + "rules/macos/office_macro_exploitation.yml": false, + "rules/macos/osascript_encoded_execution.yml": false, + "rules/macos/plistbuddy_persistence.yml": false, + "rules/macos/privacy_preferences_tampering.yml": false, + "rules/macos/root_account_enable.yml": false, + "rules/macos/security_tools_disabling.yml": false, + "rules/macos/shell_profile_modification.yml": false, + "rules/macos/ssh_key_theft.yml": false, + "rules/macos/sudo_caching_abuse.yml": false, + "rules/macos/system_integrity_protection_bypass.yml": false, + "rules/macos/system_log_clearing.yml": false, + "rules/macos/tcc_database_manipulation.yml": false, + "rules/macos/time_machine_backup_deletion.yml": false, + "rules/macos/wizardupdate_malware.yml": false, + "rules/macos/xcsset_malware.yml": false, + "rules/macos/xprotect_evasion.yml": false + }, + "checkHistoryPlaceholders": true + }, + { + "name": "jxa_in_memory_execution native positive", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"osascript\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"osascript -l JavaScript -e eval ObjC.import\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": { + "origin.host": "mac-lab", + "origin.process": "osascript", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "osascript -l JavaScript -e eval ObjC.import", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "rules": { + "rules/macos/jxa_in_memory_execution.yml": true + }, + "checkHistoryPlaceholders": true + }, + { + "name": "jxa_in_memory_execution native negative", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"osascript\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": {}, + "absent": [], + "rules": { + "rules/macos/admin_group_addition.yml": false, + "rules/macos/apple_script_abuse.yml": false, + "rules/macos/browser_child_process_exploitation.yml": false, + "rules/macos/cron_job_persistence.yml": false, + "rules/macos/dylib_hijacking.yml": false, + "rules/macos/endpoint_security_bypass.yml": false, + "rules/macos/folder_action_scripts.yml": false, + "rules/macos/gatekeeper_bypass_attempts.yml": false, + "rules/macos/gatekeeper_xattr_bypass.yml": false, + "rules/macos/gui_input_capture.yml": false, + "rules/macos/hidden_user_creation.yml": false, + "rules/macos/jxa_in_memory_execution.yml": false, + "rules/macos/kernel_extension_loading.yml": false, + "rules/macos/keychain_access_violations.yml": false, + "rules/macos/keychain_credential_dumping.yml": false, + "rules/macos/keychain_dumping_cli.yml": false, + "rules/macos/launch_agent_daemon_persistence.yml": false, + "rules/macos/login_items_persistence.yml": false, + "rules/macos/macos_ransomware_indicators.yml": false, + "rules/macos/notarization_bypass_attempts.yml": false, + "rules/macos/office_macro_exploitation.yml": false, + "rules/macos/osascript_encoded_execution.yml": false, + "rules/macos/plistbuddy_persistence.yml": false, + "rules/macos/privacy_preferences_tampering.yml": false, + "rules/macos/root_account_enable.yml": false, + "rules/macos/security_tools_disabling.yml": false, + "rules/macos/shell_profile_modification.yml": false, + "rules/macos/ssh_key_theft.yml": false, + "rules/macos/sudo_caching_abuse.yml": false, + "rules/macos/system_integrity_protection_bypass.yml": false, + "rules/macos/system_log_clearing.yml": false, + "rules/macos/tcc_database_manipulation.yml": false, + "rules/macos/time_machine_backup_deletion.yml": false, + "rules/macos/wizardupdate_malware.yml": false, + "rules/macos/xcsset_malware.yml": false, + "rules/macos/xprotect_evasion.yml": false + }, + "checkHistoryPlaceholders": true + }, + { + "name": "kernel_extension_loading native positive", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"kernel\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"kext unsigned third party load\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": { + "origin.host": "mac-lab", + "origin.process": "kernel", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "kext unsigned third party load", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "rules": { + "rules/macos/kernel_extension_loading.yml": true + }, + "checkHistoryPlaceholders": true + }, + { + "name": "kernel_extension_loading native negative", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"kernel\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": {}, + "absent": [], + "rules": { + "rules/macos/admin_group_addition.yml": false, + "rules/macos/apple_script_abuse.yml": false, + "rules/macos/browser_child_process_exploitation.yml": false, + "rules/macos/cron_job_persistence.yml": false, + "rules/macos/dylib_hijacking.yml": false, + "rules/macos/endpoint_security_bypass.yml": false, + "rules/macos/folder_action_scripts.yml": false, + "rules/macos/gatekeeper_bypass_attempts.yml": false, + "rules/macos/gatekeeper_xattr_bypass.yml": false, + "rules/macos/gui_input_capture.yml": false, + "rules/macos/hidden_user_creation.yml": false, + "rules/macos/jxa_in_memory_execution.yml": false, + "rules/macos/kernel_extension_loading.yml": false, + "rules/macos/keychain_access_violations.yml": false, + "rules/macos/keychain_credential_dumping.yml": false, + "rules/macos/keychain_dumping_cli.yml": false, + "rules/macos/launch_agent_daemon_persistence.yml": false, + "rules/macos/login_items_persistence.yml": false, + "rules/macos/macos_ransomware_indicators.yml": false, + "rules/macos/notarization_bypass_attempts.yml": false, + "rules/macos/office_macro_exploitation.yml": false, + "rules/macos/osascript_encoded_execution.yml": false, + "rules/macos/plistbuddy_persistence.yml": false, + "rules/macos/privacy_preferences_tampering.yml": false, + "rules/macos/root_account_enable.yml": false, + "rules/macos/security_tools_disabling.yml": false, + "rules/macos/shell_profile_modification.yml": false, + "rules/macos/ssh_key_theft.yml": false, + "rules/macos/sudo_caching_abuse.yml": false, + "rules/macos/system_integrity_protection_bypass.yml": false, + "rules/macos/system_log_clearing.yml": false, + "rules/macos/tcc_database_manipulation.yml": false, + "rules/macos/time_machine_backup_deletion.yml": false, + "rules/macos/wizardupdate_malware.yml": false, + "rules/macos/xcsset_malware.yml": false, + "rules/macos/xprotect_evasion.yml": false + }, + "checkHistoryPlaceholders": true + }, + { + "name": "keychain_access_violations native positive", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"securityd\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"error\",\"message\":\"keychain access denied\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": { + "origin.host": "mac-lab", + "origin.process": "securityd", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "keychain access denied", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "error" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "rules": { + "rules/macos/keychain_access_violations.yml": true + }, + "checkHistoryPlaceholders": true + }, + { + "name": "keychain_access_violations native negative", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"securityd\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": {}, + "absent": [], + "rules": { + "rules/macos/admin_group_addition.yml": false, + "rules/macos/apple_script_abuse.yml": false, + "rules/macos/browser_child_process_exploitation.yml": false, + "rules/macos/cron_job_persistence.yml": false, + "rules/macos/dylib_hijacking.yml": false, + "rules/macos/endpoint_security_bypass.yml": false, + "rules/macos/folder_action_scripts.yml": false, + "rules/macos/gatekeeper_bypass_attempts.yml": false, + "rules/macos/gatekeeper_xattr_bypass.yml": false, + "rules/macos/gui_input_capture.yml": false, + "rules/macos/hidden_user_creation.yml": false, + "rules/macos/jxa_in_memory_execution.yml": false, + "rules/macos/kernel_extension_loading.yml": false, + "rules/macos/keychain_access_violations.yml": false, + "rules/macos/keychain_credential_dumping.yml": false, + "rules/macos/keychain_dumping_cli.yml": false, + "rules/macos/launch_agent_daemon_persistence.yml": false, + "rules/macos/login_items_persistence.yml": false, + "rules/macos/macos_ransomware_indicators.yml": false, + "rules/macos/notarization_bypass_attempts.yml": false, + "rules/macos/office_macro_exploitation.yml": false, + "rules/macos/osascript_encoded_execution.yml": false, + "rules/macos/plistbuddy_persistence.yml": false, + "rules/macos/privacy_preferences_tampering.yml": false, + "rules/macos/root_account_enable.yml": false, + "rules/macos/security_tools_disabling.yml": false, + "rules/macos/shell_profile_modification.yml": false, + "rules/macos/ssh_key_theft.yml": false, + "rules/macos/sudo_caching_abuse.yml": false, + "rules/macos/system_integrity_protection_bypass.yml": false, + "rules/macos/system_log_clearing.yml": false, + "rules/macos/tcc_database_manipulation.yml": false, + "rules/macos/time_machine_backup_deletion.yml": false, + "rules/macos/wizardupdate_malware.yml": false, + "rules/macos/xcsset_malware.yml": false, + "rules/macos/xprotect_evasion.yml": false + }, + "checkHistoryPlaceholders": true + }, + { + "name": "keychain_credential_dumping native positive", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"security\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"dump-keychain\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": { + "origin.host": "mac-lab", + "origin.process": "security", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "dump-keychain", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "rules": { + "rules/macos/keychain_credential_dumping.yml": true + }, + "checkHistoryPlaceholders": true + }, + { + "name": "keychain_credential_dumping native negative", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"security\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": {}, + "absent": [], + "rules": { + "rules/macos/admin_group_addition.yml": false, + "rules/macos/apple_script_abuse.yml": false, + "rules/macos/browser_child_process_exploitation.yml": false, + "rules/macos/cron_job_persistence.yml": false, + "rules/macos/dylib_hijacking.yml": false, + "rules/macos/endpoint_security_bypass.yml": false, + "rules/macos/folder_action_scripts.yml": false, + "rules/macos/gatekeeper_bypass_attempts.yml": false, + "rules/macos/gatekeeper_xattr_bypass.yml": false, + "rules/macos/gui_input_capture.yml": false, + "rules/macos/hidden_user_creation.yml": false, + "rules/macos/jxa_in_memory_execution.yml": false, + "rules/macos/kernel_extension_loading.yml": false, + "rules/macos/keychain_access_violations.yml": false, + "rules/macos/keychain_credential_dumping.yml": false, + "rules/macos/keychain_dumping_cli.yml": false, + "rules/macos/launch_agent_daemon_persistence.yml": false, + "rules/macos/login_items_persistence.yml": false, + "rules/macos/macos_ransomware_indicators.yml": false, + "rules/macos/notarization_bypass_attempts.yml": false, + "rules/macos/office_macro_exploitation.yml": false, + "rules/macos/osascript_encoded_execution.yml": false, + "rules/macos/plistbuddy_persistence.yml": false, + "rules/macos/privacy_preferences_tampering.yml": false, + "rules/macos/root_account_enable.yml": false, + "rules/macos/security_tools_disabling.yml": false, + "rules/macos/shell_profile_modification.yml": false, + "rules/macos/ssh_key_theft.yml": false, + "rules/macos/sudo_caching_abuse.yml": false, + "rules/macos/system_integrity_protection_bypass.yml": false, + "rules/macos/system_log_clearing.yml": false, + "rules/macos/tcc_database_manipulation.yml": false, + "rules/macos/time_machine_backup_deletion.yml": false, + "rules/macos/wizardupdate_malware.yml": false, + "rules/macos/xcsset_malware.yml": false, + "rules/macos/xprotect_evasion.yml": false + }, + "checkHistoryPlaceholders": true + }, + { + "name": "keychain_dumping_cli native positive", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"security\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"find-generic-password -w\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": { + "origin.host": "mac-lab", + "origin.process": "security", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "find-generic-password -w", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "rules": { + "rules/macos/keychain_dumping_cli.yml": true + }, + "checkHistoryPlaceholders": true + }, + { + "name": "keychain_dumping_cli native negative", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"security\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": {}, + "absent": [], + "rules": { + "rules/macos/admin_group_addition.yml": false, + "rules/macos/apple_script_abuse.yml": false, + "rules/macos/browser_child_process_exploitation.yml": false, + "rules/macos/cron_job_persistence.yml": false, + "rules/macos/dylib_hijacking.yml": false, + "rules/macos/endpoint_security_bypass.yml": false, + "rules/macos/folder_action_scripts.yml": false, + "rules/macos/gatekeeper_bypass_attempts.yml": false, + "rules/macos/gatekeeper_xattr_bypass.yml": false, + "rules/macos/gui_input_capture.yml": false, + "rules/macos/hidden_user_creation.yml": false, + "rules/macos/jxa_in_memory_execution.yml": false, + "rules/macos/kernel_extension_loading.yml": false, + "rules/macos/keychain_access_violations.yml": false, + "rules/macos/keychain_credential_dumping.yml": false, + "rules/macos/keychain_dumping_cli.yml": false, + "rules/macos/launch_agent_daemon_persistence.yml": false, + "rules/macos/login_items_persistence.yml": false, + "rules/macos/macos_ransomware_indicators.yml": false, + "rules/macos/notarization_bypass_attempts.yml": false, + "rules/macos/office_macro_exploitation.yml": false, + "rules/macos/osascript_encoded_execution.yml": false, + "rules/macos/plistbuddy_persistence.yml": false, + "rules/macos/privacy_preferences_tampering.yml": false, + "rules/macos/root_account_enable.yml": false, + "rules/macos/security_tools_disabling.yml": false, + "rules/macos/shell_profile_modification.yml": false, + "rules/macos/ssh_key_theft.yml": false, + "rules/macos/sudo_caching_abuse.yml": false, + "rules/macos/system_integrity_protection_bypass.yml": false, + "rules/macos/system_log_clearing.yml": false, + "rules/macos/tcc_database_manipulation.yml": false, + "rules/macos/time_machine_backup_deletion.yml": false, + "rules/macos/wizardupdate_malware.yml": false, + "rules/macos/xcsset_malware.yml": false, + "rules/macos/xprotect_evasion.yml": false + }, + "checkHistoryPlaceholders": true + }, + { + "name": "launch_agent_daemon_persistence native positive", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"launchd\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"LaunchAgent created /Library/LaunchAgents/example.plist\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": { + "origin.host": "mac-lab", + "origin.process": "launchd", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "LaunchAgent created /Library/LaunchAgents/example.plist", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "rules": { + "rules/macos/launch_agent_daemon_persistence.yml": true + }, + "checkHistoryPlaceholders": true + }, + { + "name": "launch_agent_daemon_persistence native negative", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"launchd\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": {}, + "absent": [], + "rules": { + "rules/macos/admin_group_addition.yml": false, + "rules/macos/apple_script_abuse.yml": false, + "rules/macos/browser_child_process_exploitation.yml": false, + "rules/macos/cron_job_persistence.yml": false, + "rules/macos/dylib_hijacking.yml": false, + "rules/macos/endpoint_security_bypass.yml": false, + "rules/macos/folder_action_scripts.yml": false, + "rules/macos/gatekeeper_bypass_attempts.yml": false, + "rules/macos/gatekeeper_xattr_bypass.yml": false, + "rules/macos/gui_input_capture.yml": false, + "rules/macos/hidden_user_creation.yml": false, + "rules/macos/jxa_in_memory_execution.yml": false, + "rules/macos/kernel_extension_loading.yml": false, + "rules/macos/keychain_access_violations.yml": false, + "rules/macos/keychain_credential_dumping.yml": false, + "rules/macos/keychain_dumping_cli.yml": false, + "rules/macos/launch_agent_daemon_persistence.yml": false, + "rules/macos/login_items_persistence.yml": false, + "rules/macos/macos_ransomware_indicators.yml": false, + "rules/macos/notarization_bypass_attempts.yml": false, + "rules/macos/office_macro_exploitation.yml": false, + "rules/macos/osascript_encoded_execution.yml": false, + "rules/macos/plistbuddy_persistence.yml": false, + "rules/macos/privacy_preferences_tampering.yml": false, + "rules/macos/root_account_enable.yml": false, + "rules/macos/security_tools_disabling.yml": false, + "rules/macos/shell_profile_modification.yml": false, + "rules/macos/ssh_key_theft.yml": false, + "rules/macos/sudo_caching_abuse.yml": false, + "rules/macos/system_integrity_protection_bypass.yml": false, + "rules/macos/system_log_clearing.yml": false, + "rules/macos/tcc_database_manipulation.yml": false, + "rules/macos/time_machine_backup_deletion.yml": false, + "rules/macos/wizardupdate_malware.yml": false, + "rules/macos/xcsset_malware.yml": false, + "rules/macos/xprotect_evasion.yml": false + }, + "checkHistoryPlaceholders": true + }, + { + "name": "login_items_persistence native positive", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"loginwindow\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Login Item added\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": { + "origin.host": "mac-lab", + "origin.process": "loginwindow", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "Login Item added", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "rules": { + "rules/macos/login_items_persistence.yml": true + }, + "checkHistoryPlaceholders": true + }, + { + "name": "login_items_persistence native negative", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"loginwindow\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": {}, + "absent": [], + "rules": { + "rules/macos/admin_group_addition.yml": false, + "rules/macos/apple_script_abuse.yml": false, + "rules/macos/browser_child_process_exploitation.yml": false, + "rules/macos/cron_job_persistence.yml": false, + "rules/macos/dylib_hijacking.yml": false, + "rules/macos/endpoint_security_bypass.yml": false, + "rules/macos/folder_action_scripts.yml": false, + "rules/macos/gatekeeper_bypass_attempts.yml": false, + "rules/macos/gatekeeper_xattr_bypass.yml": false, + "rules/macos/gui_input_capture.yml": false, + "rules/macos/hidden_user_creation.yml": false, + "rules/macos/jxa_in_memory_execution.yml": false, + "rules/macos/kernel_extension_loading.yml": false, + "rules/macos/keychain_access_violations.yml": false, + "rules/macos/keychain_credential_dumping.yml": false, + "rules/macos/keychain_dumping_cli.yml": false, + "rules/macos/launch_agent_daemon_persistence.yml": false, + "rules/macos/login_items_persistence.yml": false, + "rules/macos/macos_ransomware_indicators.yml": false, + "rules/macos/notarization_bypass_attempts.yml": false, + "rules/macos/office_macro_exploitation.yml": false, + "rules/macos/osascript_encoded_execution.yml": false, + "rules/macos/plistbuddy_persistence.yml": false, + "rules/macos/privacy_preferences_tampering.yml": false, + "rules/macos/root_account_enable.yml": false, + "rules/macos/security_tools_disabling.yml": false, + "rules/macos/shell_profile_modification.yml": false, + "rules/macos/ssh_key_theft.yml": false, + "rules/macos/sudo_caching_abuse.yml": false, + "rules/macos/system_integrity_protection_bypass.yml": false, + "rules/macos/system_log_clearing.yml": false, + "rules/macos/tcc_database_manipulation.yml": false, + "rules/macos/time_machine_backup_deletion.yml": false, + "rules/macos/wizardupdate_malware.yml": false, + "rules/macos/xcsset_malware.yml": false, + "rules/macos/xprotect_evasion.yml": false + }, + "checkHistoryPlaceholders": true + }, + { + "name": "macos_ransomware_indicators native positive", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"filewriter\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"rename encrypted report.locked\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": { + "origin.host": "mac-lab", + "origin.process": "filewriter", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "rename encrypted report.locked", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "rules": { + "rules/macos/macos_ransomware_indicators.yml": true + }, + "checkHistoryPlaceholders": true + }, + { + "name": "macos_ransomware_indicators native negative", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"filewriter\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": {}, + "absent": [], + "rules": { + "rules/macos/admin_group_addition.yml": false, + "rules/macos/apple_script_abuse.yml": false, + "rules/macos/browser_child_process_exploitation.yml": false, + "rules/macos/cron_job_persistence.yml": false, + "rules/macos/dylib_hijacking.yml": false, + "rules/macos/endpoint_security_bypass.yml": false, + "rules/macos/folder_action_scripts.yml": false, + "rules/macos/gatekeeper_bypass_attempts.yml": false, + "rules/macos/gatekeeper_xattr_bypass.yml": false, + "rules/macos/gui_input_capture.yml": false, + "rules/macos/hidden_user_creation.yml": false, + "rules/macos/jxa_in_memory_execution.yml": false, + "rules/macos/kernel_extension_loading.yml": false, + "rules/macos/keychain_access_violations.yml": false, + "rules/macos/keychain_credential_dumping.yml": false, + "rules/macos/keychain_dumping_cli.yml": false, + "rules/macos/launch_agent_daemon_persistence.yml": false, + "rules/macos/login_items_persistence.yml": false, + "rules/macos/macos_ransomware_indicators.yml": false, + "rules/macos/notarization_bypass_attempts.yml": false, + "rules/macos/office_macro_exploitation.yml": false, + "rules/macos/osascript_encoded_execution.yml": false, + "rules/macos/plistbuddy_persistence.yml": false, + "rules/macos/privacy_preferences_tampering.yml": false, + "rules/macos/root_account_enable.yml": false, + "rules/macos/security_tools_disabling.yml": false, + "rules/macos/shell_profile_modification.yml": false, + "rules/macos/ssh_key_theft.yml": false, + "rules/macos/sudo_caching_abuse.yml": false, + "rules/macos/system_integrity_protection_bypass.yml": false, + "rules/macos/system_log_clearing.yml": false, + "rules/macos/tcc_database_manipulation.yml": false, + "rules/macos/time_machine_backup_deletion.yml": false, + "rules/macos/wizardupdate_malware.yml": false, + "rules/macos/xcsset_malware.yml": false, + "rules/macos/xprotect_evasion.yml": false + }, + "checkHistoryPlaceholders": true + }, + { + "name": "notarization_bypass_attempts native positive", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"xattr\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"-d com.apple.quarantine\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": { + "origin.host": "mac-lab", + "origin.process": "xattr", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "-d com.apple.quarantine", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "rules": { + "rules/macos/notarization_bypass_attempts.yml": true + }, + "checkHistoryPlaceholders": true + }, + { + "name": "notarization_bypass_attempts native negative", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"xattr\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": {}, + "absent": [], + "rules": { + "rules/macos/admin_group_addition.yml": false, + "rules/macos/apple_script_abuse.yml": false, + "rules/macos/browser_child_process_exploitation.yml": false, + "rules/macos/cron_job_persistence.yml": false, + "rules/macos/dylib_hijacking.yml": false, + "rules/macos/endpoint_security_bypass.yml": false, + "rules/macos/folder_action_scripts.yml": false, + "rules/macos/gatekeeper_bypass_attempts.yml": false, + "rules/macos/gatekeeper_xattr_bypass.yml": false, + "rules/macos/gui_input_capture.yml": false, + "rules/macos/hidden_user_creation.yml": false, + "rules/macos/jxa_in_memory_execution.yml": false, + "rules/macos/kernel_extension_loading.yml": false, + "rules/macos/keychain_access_violations.yml": false, + "rules/macos/keychain_credential_dumping.yml": false, + "rules/macos/keychain_dumping_cli.yml": false, + "rules/macos/launch_agent_daemon_persistence.yml": false, + "rules/macos/login_items_persistence.yml": false, + "rules/macos/macos_ransomware_indicators.yml": false, + "rules/macos/notarization_bypass_attempts.yml": false, + "rules/macos/office_macro_exploitation.yml": false, + "rules/macos/osascript_encoded_execution.yml": false, + "rules/macos/plistbuddy_persistence.yml": false, + "rules/macos/privacy_preferences_tampering.yml": false, + "rules/macos/root_account_enable.yml": false, + "rules/macos/security_tools_disabling.yml": false, + "rules/macos/shell_profile_modification.yml": false, + "rules/macos/ssh_key_theft.yml": false, + "rules/macos/sudo_caching_abuse.yml": false, + "rules/macos/system_integrity_protection_bypass.yml": false, + "rules/macos/system_log_clearing.yml": false, + "rules/macos/tcc_database_manipulation.yml": false, + "rules/macos/time_machine_backup_deletion.yml": false, + "rules/macos/wizardupdate_malware.yml": false, + "rules/macos/xcsset_malware.yml": false, + "rules/macos/xprotect_evasion.yml": false + }, + "checkHistoryPlaceholders": true + }, + { + "name": "office_macro_exploitation native positive", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"Word\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Microsoft Word spawned child process bash\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": { + "origin.host": "mac-lab", + "origin.process": "Word", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "Microsoft Word spawned child process bash", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "rules": { + "rules/macos/office_macro_exploitation.yml": true + }, + "checkHistoryPlaceholders": true + }, + { + "name": "office_macro_exploitation native negative", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"Word\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": {}, + "absent": [], + "rules": { + "rules/macos/admin_group_addition.yml": false, + "rules/macos/apple_script_abuse.yml": false, + "rules/macos/browser_child_process_exploitation.yml": false, + "rules/macos/cron_job_persistence.yml": false, + "rules/macos/dylib_hijacking.yml": false, + "rules/macos/endpoint_security_bypass.yml": false, + "rules/macos/folder_action_scripts.yml": false, + "rules/macos/gatekeeper_bypass_attempts.yml": false, + "rules/macos/gatekeeper_xattr_bypass.yml": false, + "rules/macos/gui_input_capture.yml": false, + "rules/macos/hidden_user_creation.yml": false, + "rules/macos/jxa_in_memory_execution.yml": false, + "rules/macos/kernel_extension_loading.yml": false, + "rules/macos/keychain_access_violations.yml": false, + "rules/macos/keychain_credential_dumping.yml": false, + "rules/macos/keychain_dumping_cli.yml": false, + "rules/macos/launch_agent_daemon_persistence.yml": false, + "rules/macos/login_items_persistence.yml": false, + "rules/macos/macos_ransomware_indicators.yml": false, + "rules/macos/notarization_bypass_attempts.yml": false, + "rules/macos/office_macro_exploitation.yml": false, + "rules/macos/osascript_encoded_execution.yml": false, + "rules/macos/plistbuddy_persistence.yml": false, + "rules/macos/privacy_preferences_tampering.yml": false, + "rules/macos/root_account_enable.yml": false, + "rules/macos/security_tools_disabling.yml": false, + "rules/macos/shell_profile_modification.yml": false, + "rules/macos/ssh_key_theft.yml": false, + "rules/macos/sudo_caching_abuse.yml": false, + "rules/macos/system_integrity_protection_bypass.yml": false, + "rules/macos/system_log_clearing.yml": false, + "rules/macos/tcc_database_manipulation.yml": false, + "rules/macos/time_machine_backup_deletion.yml": false, + "rules/macos/wizardupdate_malware.yml": false, + "rules/macos/xcsset_malware.yml": false, + "rules/macos/xprotect_evasion.yml": false + }, + "checkHistoryPlaceholders": true + }, + { + "name": "osascript_encoded_execution native positive", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"osascript\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"osascript -e do shell script /bin/bash\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": { + "origin.host": "mac-lab", + "origin.process": "osascript", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "osascript -e do shell script /bin/bash", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "rules": { + "rules/macos/osascript_encoded_execution.yml": true + }, + "checkHistoryPlaceholders": true + }, + { + "name": "osascript_encoded_execution native negative", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"osascript\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": {}, + "absent": [], + "rules": { + "rules/macos/admin_group_addition.yml": false, + "rules/macos/apple_script_abuse.yml": false, + "rules/macos/browser_child_process_exploitation.yml": false, + "rules/macos/cron_job_persistence.yml": false, + "rules/macos/dylib_hijacking.yml": false, + "rules/macos/endpoint_security_bypass.yml": false, + "rules/macos/folder_action_scripts.yml": false, + "rules/macos/gatekeeper_bypass_attempts.yml": false, + "rules/macos/gatekeeper_xattr_bypass.yml": false, + "rules/macos/gui_input_capture.yml": false, + "rules/macos/hidden_user_creation.yml": false, + "rules/macos/jxa_in_memory_execution.yml": false, + "rules/macos/kernel_extension_loading.yml": false, + "rules/macos/keychain_access_violations.yml": false, + "rules/macos/keychain_credential_dumping.yml": false, + "rules/macos/keychain_dumping_cli.yml": false, + "rules/macos/launch_agent_daemon_persistence.yml": false, + "rules/macos/login_items_persistence.yml": false, + "rules/macos/macos_ransomware_indicators.yml": false, + "rules/macos/notarization_bypass_attempts.yml": false, + "rules/macos/office_macro_exploitation.yml": false, + "rules/macos/osascript_encoded_execution.yml": false, + "rules/macos/plistbuddy_persistence.yml": false, + "rules/macos/privacy_preferences_tampering.yml": false, + "rules/macos/root_account_enable.yml": false, + "rules/macos/security_tools_disabling.yml": false, + "rules/macos/shell_profile_modification.yml": false, + "rules/macos/ssh_key_theft.yml": false, + "rules/macos/sudo_caching_abuse.yml": false, + "rules/macos/system_integrity_protection_bypass.yml": false, + "rules/macos/system_log_clearing.yml": false, + "rules/macos/tcc_database_manipulation.yml": false, + "rules/macos/time_machine_backup_deletion.yml": false, + "rules/macos/wizardupdate_malware.yml": false, + "rules/macos/xcsset_malware.yml": false, + "rules/macos/xprotect_evasion.yml": false + }, + "checkHistoryPlaceholders": true + }, + { + "name": "plistbuddy_persistence native positive", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"PlistBuddy\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"PlistBuddy RunAtLoad /Library/LaunchAgents/example.plist\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": { + "origin.host": "mac-lab", + "origin.process": "PlistBuddy", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "PlistBuddy RunAtLoad /Library/LaunchAgents/example.plist", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "rules": { + "rules/macos/plistbuddy_persistence.yml": true + }, + "checkHistoryPlaceholders": true + }, + { + "name": "plistbuddy_persistence native negative", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"PlistBuddy\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": {}, + "absent": [], + "rules": { + "rules/macos/admin_group_addition.yml": false, + "rules/macos/apple_script_abuse.yml": false, + "rules/macos/browser_child_process_exploitation.yml": false, + "rules/macos/cron_job_persistence.yml": false, + "rules/macos/dylib_hijacking.yml": false, + "rules/macos/endpoint_security_bypass.yml": false, + "rules/macos/folder_action_scripts.yml": false, + "rules/macos/gatekeeper_bypass_attempts.yml": false, + "rules/macos/gatekeeper_xattr_bypass.yml": false, + "rules/macos/gui_input_capture.yml": false, + "rules/macos/hidden_user_creation.yml": false, + "rules/macos/jxa_in_memory_execution.yml": false, + "rules/macos/kernel_extension_loading.yml": false, + "rules/macos/keychain_access_violations.yml": false, + "rules/macos/keychain_credential_dumping.yml": false, + "rules/macos/keychain_dumping_cli.yml": false, + "rules/macos/launch_agent_daemon_persistence.yml": false, + "rules/macos/login_items_persistence.yml": false, + "rules/macos/macos_ransomware_indicators.yml": false, + "rules/macos/notarization_bypass_attempts.yml": false, + "rules/macos/office_macro_exploitation.yml": false, + "rules/macos/osascript_encoded_execution.yml": false, + "rules/macos/plistbuddy_persistence.yml": false, + "rules/macos/privacy_preferences_tampering.yml": false, + "rules/macos/root_account_enable.yml": false, + "rules/macos/security_tools_disabling.yml": false, + "rules/macos/shell_profile_modification.yml": false, + "rules/macos/ssh_key_theft.yml": false, + "rules/macos/sudo_caching_abuse.yml": false, + "rules/macos/system_integrity_protection_bypass.yml": false, + "rules/macos/system_log_clearing.yml": false, + "rules/macos/tcc_database_manipulation.yml": false, + "rules/macos/time_machine_backup_deletion.yml": false, + "rules/macos/wizardupdate_malware.yml": false, + "rules/macos/xcsset_malware.yml": false, + "rules/macos/xprotect_evasion.yml": false + }, + "checkHistoryPlaceholders": true + }, + { + "name": "privacy_preferences_tampering native positive", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"tccutil\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"reset\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": { + "origin.host": "mac-lab", + "origin.process": "tccutil", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "reset", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "rules": { + "rules/macos/privacy_preferences_tampering.yml": true + }, + "checkHistoryPlaceholders": true + }, + { + "name": "privacy_preferences_tampering native negative", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"tccutil\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": {}, + "absent": [], + "rules": { + "rules/macos/admin_group_addition.yml": false, + "rules/macos/apple_script_abuse.yml": false, + "rules/macos/browser_child_process_exploitation.yml": false, + "rules/macos/cron_job_persistence.yml": false, + "rules/macos/dylib_hijacking.yml": false, + "rules/macos/endpoint_security_bypass.yml": false, + "rules/macos/folder_action_scripts.yml": false, + "rules/macos/gatekeeper_bypass_attempts.yml": false, + "rules/macos/gatekeeper_xattr_bypass.yml": false, + "rules/macos/gui_input_capture.yml": false, + "rules/macos/hidden_user_creation.yml": false, + "rules/macos/jxa_in_memory_execution.yml": false, + "rules/macos/kernel_extension_loading.yml": false, + "rules/macos/keychain_access_violations.yml": false, + "rules/macos/keychain_credential_dumping.yml": false, + "rules/macos/keychain_dumping_cli.yml": false, + "rules/macos/launch_agent_daemon_persistence.yml": false, + "rules/macos/login_items_persistence.yml": false, + "rules/macos/macos_ransomware_indicators.yml": false, + "rules/macos/notarization_bypass_attempts.yml": false, + "rules/macos/office_macro_exploitation.yml": false, + "rules/macos/osascript_encoded_execution.yml": false, + "rules/macos/plistbuddy_persistence.yml": false, + "rules/macos/privacy_preferences_tampering.yml": false, + "rules/macos/root_account_enable.yml": false, + "rules/macos/security_tools_disabling.yml": false, + "rules/macos/shell_profile_modification.yml": false, + "rules/macos/ssh_key_theft.yml": false, + "rules/macos/sudo_caching_abuse.yml": false, + "rules/macos/system_integrity_protection_bypass.yml": false, + "rules/macos/system_log_clearing.yml": false, + "rules/macos/tcc_database_manipulation.yml": false, + "rules/macos/time_machine_backup_deletion.yml": false, + "rules/macos/wizardupdate_malware.yml": false, + "rules/macos/xcsset_malware.yml": false, + "rules/macos/xprotect_evasion.yml": false + }, + "checkHistoryPlaceholders": true + }, + { + "name": "root_account_enable native positive", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"dsenableroot\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"dsenableroot enabled root\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": { + "origin.host": "mac-lab", + "origin.process": "dsenableroot", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "dsenableroot enabled root", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "rules": { + "rules/macos/root_account_enable.yml": true + }, + "checkHistoryPlaceholders": true + }, + { + "name": "root_account_enable native negative", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"dsenableroot\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": {}, + "absent": [], + "rules": { + "rules/macos/admin_group_addition.yml": false, + "rules/macos/apple_script_abuse.yml": false, + "rules/macos/browser_child_process_exploitation.yml": false, + "rules/macos/cron_job_persistence.yml": false, + "rules/macos/dylib_hijacking.yml": false, + "rules/macos/endpoint_security_bypass.yml": false, + "rules/macos/folder_action_scripts.yml": false, + "rules/macos/gatekeeper_bypass_attempts.yml": false, + "rules/macos/gatekeeper_xattr_bypass.yml": false, + "rules/macos/gui_input_capture.yml": false, + "rules/macos/hidden_user_creation.yml": false, + "rules/macos/jxa_in_memory_execution.yml": false, + "rules/macos/kernel_extension_loading.yml": false, + "rules/macos/keychain_access_violations.yml": false, + "rules/macos/keychain_credential_dumping.yml": false, + "rules/macos/keychain_dumping_cli.yml": false, + "rules/macos/launch_agent_daemon_persistence.yml": false, + "rules/macos/login_items_persistence.yml": false, + "rules/macos/macos_ransomware_indicators.yml": false, + "rules/macos/notarization_bypass_attempts.yml": false, + "rules/macos/office_macro_exploitation.yml": false, + "rules/macos/osascript_encoded_execution.yml": false, + "rules/macos/plistbuddy_persistence.yml": false, + "rules/macos/privacy_preferences_tampering.yml": false, + "rules/macos/root_account_enable.yml": false, + "rules/macos/security_tools_disabling.yml": false, + "rules/macos/shell_profile_modification.yml": false, + "rules/macos/ssh_key_theft.yml": false, + "rules/macos/sudo_caching_abuse.yml": false, + "rules/macos/system_integrity_protection_bypass.yml": false, + "rules/macos/system_log_clearing.yml": false, + "rules/macos/tcc_database_manipulation.yml": false, + "rules/macos/time_machine_backup_deletion.yml": false, + "rules/macos/wizardupdate_malware.yml": false, + "rules/macos/xcsset_malware.yml": false, + "rules/macos/xprotect_evasion.yml": false + }, + "checkHistoryPlaceholders": true + }, + { + "name": "security_tools_disabling native positive", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"launchctl\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"launchctl unload com.crowdstrike.agent\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": { + "origin.host": "mac-lab", + "origin.process": "launchctl", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "launchctl unload com.crowdstrike.agent", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "rules": { + "rules/macos/security_tools_disabling.yml": true + }, + "checkHistoryPlaceholders": true + }, + { + "name": "security_tools_disabling native negative", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"launchctl\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": {}, + "absent": [], + "rules": { + "rules/macos/admin_group_addition.yml": false, + "rules/macos/apple_script_abuse.yml": false, + "rules/macos/browser_child_process_exploitation.yml": false, + "rules/macos/cron_job_persistence.yml": false, + "rules/macos/dylib_hijacking.yml": false, + "rules/macos/endpoint_security_bypass.yml": false, + "rules/macos/folder_action_scripts.yml": false, + "rules/macos/gatekeeper_bypass_attempts.yml": false, + "rules/macos/gatekeeper_xattr_bypass.yml": false, + "rules/macos/gui_input_capture.yml": false, + "rules/macos/hidden_user_creation.yml": false, + "rules/macos/jxa_in_memory_execution.yml": false, + "rules/macos/kernel_extension_loading.yml": false, + "rules/macos/keychain_access_violations.yml": false, + "rules/macos/keychain_credential_dumping.yml": false, + "rules/macos/keychain_dumping_cli.yml": false, + "rules/macos/launch_agent_daemon_persistence.yml": false, + "rules/macos/login_items_persistence.yml": false, + "rules/macos/macos_ransomware_indicators.yml": false, + "rules/macos/notarization_bypass_attempts.yml": false, + "rules/macos/office_macro_exploitation.yml": false, + "rules/macos/osascript_encoded_execution.yml": false, + "rules/macos/plistbuddy_persistence.yml": false, + "rules/macos/privacy_preferences_tampering.yml": false, + "rules/macos/root_account_enable.yml": false, + "rules/macos/security_tools_disabling.yml": false, + "rules/macos/shell_profile_modification.yml": false, + "rules/macos/ssh_key_theft.yml": false, + "rules/macos/sudo_caching_abuse.yml": false, + "rules/macos/system_integrity_protection_bypass.yml": false, + "rules/macos/system_log_clearing.yml": false, + "rules/macos/tcc_database_manipulation.yml": false, + "rules/macos/time_machine_backup_deletion.yml": false, + "rules/macos/wizardupdate_malware.yml": false, + "rules/macos/xcsset_malware.yml": false, + "rules/macos/xprotect_evasion.yml": false + }, + "checkHistoryPlaceholders": true + }, + { + "name": "shell_profile_modification native positive", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"zsh\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\".zshrc modified\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": { + "origin.host": "mac-lab", + "origin.process": "zsh", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": ".zshrc modified", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "rules": { + "rules/macos/shell_profile_modification.yml": true + }, + "checkHistoryPlaceholders": true + }, + { + "name": "shell_profile_modification native negative", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"zsh\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": {}, + "absent": [], + "rules": { + "rules/macos/admin_group_addition.yml": false, + "rules/macos/apple_script_abuse.yml": false, + "rules/macos/browser_child_process_exploitation.yml": false, + "rules/macos/cron_job_persistence.yml": false, + "rules/macos/dylib_hijacking.yml": false, + "rules/macos/endpoint_security_bypass.yml": false, + "rules/macos/folder_action_scripts.yml": false, + "rules/macos/gatekeeper_bypass_attempts.yml": false, + "rules/macos/gatekeeper_xattr_bypass.yml": false, + "rules/macos/gui_input_capture.yml": false, + "rules/macos/hidden_user_creation.yml": false, + "rules/macos/jxa_in_memory_execution.yml": false, + "rules/macos/kernel_extension_loading.yml": false, + "rules/macos/keychain_access_violations.yml": false, + "rules/macos/keychain_credential_dumping.yml": false, + "rules/macos/keychain_dumping_cli.yml": false, + "rules/macos/launch_agent_daemon_persistence.yml": false, + "rules/macos/login_items_persistence.yml": false, + "rules/macos/macos_ransomware_indicators.yml": false, + "rules/macos/notarization_bypass_attempts.yml": false, + "rules/macos/office_macro_exploitation.yml": false, + "rules/macos/osascript_encoded_execution.yml": false, + "rules/macos/plistbuddy_persistence.yml": false, + "rules/macos/privacy_preferences_tampering.yml": false, + "rules/macos/root_account_enable.yml": false, + "rules/macos/security_tools_disabling.yml": false, + "rules/macos/shell_profile_modification.yml": false, + "rules/macos/ssh_key_theft.yml": false, + "rules/macos/sudo_caching_abuse.yml": false, + "rules/macos/system_integrity_protection_bypass.yml": false, + "rules/macos/system_log_clearing.yml": false, + "rules/macos/tcc_database_manipulation.yml": false, + "rules/macos/time_machine_backup_deletion.yml": false, + "rules/macos/wizardupdate_malware.yml": false, + "rules/macos/xcsset_malware.yml": false, + "rules/macos/xprotect_evasion.yml": false + }, + "checkHistoryPlaceholders": true + }, + { + "name": "ssh_key_theft native positive", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"cat\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"read .ssh/id_ed25519\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": { + "origin.host": "mac-lab", + "origin.process": "cat", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "read .ssh/id_ed25519", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "rules": { + "rules/macos/ssh_key_theft.yml": true + }, + "checkHistoryPlaceholders": true + }, + { + "name": "ssh_key_theft native negative", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"cat\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": {}, + "absent": [], + "rules": { + "rules/macos/admin_group_addition.yml": false, + "rules/macos/apple_script_abuse.yml": false, + "rules/macos/browser_child_process_exploitation.yml": false, + "rules/macos/cron_job_persistence.yml": false, + "rules/macos/dylib_hijacking.yml": false, + "rules/macos/endpoint_security_bypass.yml": false, + "rules/macos/folder_action_scripts.yml": false, + "rules/macos/gatekeeper_bypass_attempts.yml": false, + "rules/macos/gatekeeper_xattr_bypass.yml": false, + "rules/macos/gui_input_capture.yml": false, + "rules/macos/hidden_user_creation.yml": false, + "rules/macos/jxa_in_memory_execution.yml": false, + "rules/macos/kernel_extension_loading.yml": false, + "rules/macos/keychain_access_violations.yml": false, + "rules/macos/keychain_credential_dumping.yml": false, + "rules/macos/keychain_dumping_cli.yml": false, + "rules/macos/launch_agent_daemon_persistence.yml": false, + "rules/macos/login_items_persistence.yml": false, + "rules/macos/macos_ransomware_indicators.yml": false, + "rules/macos/notarization_bypass_attempts.yml": false, + "rules/macos/office_macro_exploitation.yml": false, + "rules/macos/osascript_encoded_execution.yml": false, + "rules/macos/plistbuddy_persistence.yml": false, + "rules/macos/privacy_preferences_tampering.yml": false, + "rules/macos/root_account_enable.yml": false, + "rules/macos/security_tools_disabling.yml": false, + "rules/macos/shell_profile_modification.yml": false, + "rules/macos/ssh_key_theft.yml": false, + "rules/macos/sudo_caching_abuse.yml": false, + "rules/macos/system_integrity_protection_bypass.yml": false, + "rules/macos/system_log_clearing.yml": false, + "rules/macos/tcc_database_manipulation.yml": false, + "rules/macos/time_machine_backup_deletion.yml": false, + "rules/macos/wizardupdate_malware.yml": false, + "rules/macos/xcsset_malware.yml": false, + "rules/macos/xprotect_evasion.yml": false + }, + "checkHistoryPlaceholders": true + }, + { + "name": "sudo_caching_abuse native positive", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"sudo\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"sudoers timestamp_timeout modified\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": { + "origin.host": "mac-lab", + "origin.process": "sudo", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "sudoers timestamp_timeout modified", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "rules": { + "rules/macos/sudo_caching_abuse.yml": true + }, + "checkHistoryPlaceholders": true + }, + { + "name": "sudo_caching_abuse native negative", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"sudo\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": {}, + "absent": [], + "rules": { + "rules/macos/admin_group_addition.yml": false, + "rules/macos/apple_script_abuse.yml": false, + "rules/macos/browser_child_process_exploitation.yml": false, + "rules/macos/cron_job_persistence.yml": false, + "rules/macos/dylib_hijacking.yml": false, + "rules/macos/endpoint_security_bypass.yml": false, + "rules/macos/folder_action_scripts.yml": false, + "rules/macos/gatekeeper_bypass_attempts.yml": false, + "rules/macos/gatekeeper_xattr_bypass.yml": false, + "rules/macos/gui_input_capture.yml": false, + "rules/macos/hidden_user_creation.yml": false, + "rules/macos/jxa_in_memory_execution.yml": false, + "rules/macos/kernel_extension_loading.yml": false, + "rules/macos/keychain_access_violations.yml": false, + "rules/macos/keychain_credential_dumping.yml": false, + "rules/macos/keychain_dumping_cli.yml": false, + "rules/macos/launch_agent_daemon_persistence.yml": false, + "rules/macos/login_items_persistence.yml": false, + "rules/macos/macos_ransomware_indicators.yml": false, + "rules/macos/notarization_bypass_attempts.yml": false, + "rules/macos/office_macro_exploitation.yml": false, + "rules/macos/osascript_encoded_execution.yml": false, + "rules/macos/plistbuddy_persistence.yml": false, + "rules/macos/privacy_preferences_tampering.yml": false, + "rules/macos/root_account_enable.yml": false, + "rules/macos/security_tools_disabling.yml": false, + "rules/macos/shell_profile_modification.yml": false, + "rules/macos/ssh_key_theft.yml": false, + "rules/macos/sudo_caching_abuse.yml": false, + "rules/macos/system_integrity_protection_bypass.yml": false, + "rules/macos/system_log_clearing.yml": false, + "rules/macos/tcc_database_manipulation.yml": false, + "rules/macos/time_machine_backup_deletion.yml": false, + "rules/macos/wizardupdate_malware.yml": false, + "rules/macos/xcsset_malware.yml": false, + "rules/macos/xprotect_evasion.yml": false + }, + "checkHistoryPlaceholders": true + }, + { + "name": "system_integrity_protection_bypass native positive", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"storagekitd\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"com.apple.rootless.install.heritable\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": { + "origin.host": "mac-lab", + "origin.process": "storagekitd", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "com.apple.rootless.install.heritable", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "rules": { + "rules/macos/system_integrity_protection_bypass.yml": true + }, + "checkHistoryPlaceholders": true + }, + { + "name": "system_integrity_protection_bypass native negative", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"storagekitd\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": {}, + "absent": [], + "rules": { + "rules/macos/admin_group_addition.yml": false, + "rules/macos/apple_script_abuse.yml": false, + "rules/macos/browser_child_process_exploitation.yml": false, + "rules/macos/cron_job_persistence.yml": false, + "rules/macos/dylib_hijacking.yml": false, + "rules/macos/endpoint_security_bypass.yml": false, + "rules/macos/folder_action_scripts.yml": false, + "rules/macos/gatekeeper_bypass_attempts.yml": false, + "rules/macos/gatekeeper_xattr_bypass.yml": false, + "rules/macos/gui_input_capture.yml": false, + "rules/macos/hidden_user_creation.yml": false, + "rules/macos/jxa_in_memory_execution.yml": false, + "rules/macos/kernel_extension_loading.yml": false, + "rules/macos/keychain_access_violations.yml": false, + "rules/macos/keychain_credential_dumping.yml": false, + "rules/macos/keychain_dumping_cli.yml": false, + "rules/macos/launch_agent_daemon_persistence.yml": false, + "rules/macos/login_items_persistence.yml": false, + "rules/macos/macos_ransomware_indicators.yml": false, + "rules/macos/notarization_bypass_attempts.yml": false, + "rules/macos/office_macro_exploitation.yml": false, + "rules/macos/osascript_encoded_execution.yml": false, + "rules/macos/plistbuddy_persistence.yml": false, + "rules/macos/privacy_preferences_tampering.yml": false, + "rules/macos/root_account_enable.yml": false, + "rules/macos/security_tools_disabling.yml": false, + "rules/macos/shell_profile_modification.yml": false, + "rules/macos/ssh_key_theft.yml": false, + "rules/macos/sudo_caching_abuse.yml": false, + "rules/macos/system_integrity_protection_bypass.yml": false, + "rules/macos/system_log_clearing.yml": false, + "rules/macos/tcc_database_manipulation.yml": false, + "rules/macos/time_machine_backup_deletion.yml": false, + "rules/macos/wizardupdate_malware.yml": false, + "rules/macos/xcsset_malware.yml": false, + "rules/macos/xprotect_evasion.yml": false + }, + "checkHistoryPlaceholders": true + }, + { + "name": "system_log_clearing native positive", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"log\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"log erase\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": { + "origin.host": "mac-lab", + "origin.process": "log", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "log erase", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "rules": { + "rules/macos/system_log_clearing.yml": true + }, + "checkHistoryPlaceholders": true + }, + { + "name": "system_log_clearing native negative", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"log\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": {}, + "absent": [], + "rules": { + "rules/macos/admin_group_addition.yml": false, + "rules/macos/apple_script_abuse.yml": false, + "rules/macos/browser_child_process_exploitation.yml": false, + "rules/macos/cron_job_persistence.yml": false, + "rules/macos/dylib_hijacking.yml": false, + "rules/macos/endpoint_security_bypass.yml": false, + "rules/macos/folder_action_scripts.yml": false, + "rules/macos/gatekeeper_bypass_attempts.yml": false, + "rules/macos/gatekeeper_xattr_bypass.yml": false, + "rules/macos/gui_input_capture.yml": false, + "rules/macos/hidden_user_creation.yml": false, + "rules/macos/jxa_in_memory_execution.yml": false, + "rules/macos/kernel_extension_loading.yml": false, + "rules/macos/keychain_access_violations.yml": false, + "rules/macos/keychain_credential_dumping.yml": false, + "rules/macos/keychain_dumping_cli.yml": false, + "rules/macos/launch_agent_daemon_persistence.yml": false, + "rules/macos/login_items_persistence.yml": false, + "rules/macos/macos_ransomware_indicators.yml": false, + "rules/macos/notarization_bypass_attempts.yml": false, + "rules/macos/office_macro_exploitation.yml": false, + "rules/macos/osascript_encoded_execution.yml": false, + "rules/macos/plistbuddy_persistence.yml": false, + "rules/macos/privacy_preferences_tampering.yml": false, + "rules/macos/root_account_enable.yml": false, + "rules/macos/security_tools_disabling.yml": false, + "rules/macos/shell_profile_modification.yml": false, + "rules/macos/ssh_key_theft.yml": false, + "rules/macos/sudo_caching_abuse.yml": false, + "rules/macos/system_integrity_protection_bypass.yml": false, + "rules/macos/system_log_clearing.yml": false, + "rules/macos/tcc_database_manipulation.yml": false, + "rules/macos/time_machine_backup_deletion.yml": false, + "rules/macos/wizardupdate_malware.yml": false, + "rules/macos/xcsset_malware.yml": false, + "rules/macos/xprotect_evasion.yml": false + }, + "checkHistoryPlaceholders": true + }, + { + "name": "tcc_database_manipulation native positive", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"tccd\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"unauthorized access detected\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": { + "origin.host": "mac-lab", + "origin.process": "tccd", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "unauthorized access detected", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "rules": { + "rules/macos/tcc_database_manipulation.yml": true + }, + "checkHistoryPlaceholders": true + }, + { + "name": "tcc_database_manipulation native negative", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"tccd\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": {}, + "absent": [], + "rules": { + "rules/macos/admin_group_addition.yml": false, + "rules/macos/apple_script_abuse.yml": false, + "rules/macos/browser_child_process_exploitation.yml": false, + "rules/macos/cron_job_persistence.yml": false, + "rules/macos/dylib_hijacking.yml": false, + "rules/macos/endpoint_security_bypass.yml": false, + "rules/macos/folder_action_scripts.yml": false, + "rules/macos/gatekeeper_bypass_attempts.yml": false, + "rules/macos/gatekeeper_xattr_bypass.yml": false, + "rules/macos/gui_input_capture.yml": false, + "rules/macos/hidden_user_creation.yml": false, + "rules/macos/jxa_in_memory_execution.yml": false, + "rules/macos/kernel_extension_loading.yml": false, + "rules/macos/keychain_access_violations.yml": false, + "rules/macos/keychain_credential_dumping.yml": false, + "rules/macos/keychain_dumping_cli.yml": false, + "rules/macos/launch_agent_daemon_persistence.yml": false, + "rules/macos/login_items_persistence.yml": false, + "rules/macos/macos_ransomware_indicators.yml": false, + "rules/macos/notarization_bypass_attempts.yml": false, + "rules/macos/office_macro_exploitation.yml": false, + "rules/macos/osascript_encoded_execution.yml": false, + "rules/macos/plistbuddy_persistence.yml": false, + "rules/macos/privacy_preferences_tampering.yml": false, + "rules/macos/root_account_enable.yml": false, + "rules/macos/security_tools_disabling.yml": false, + "rules/macos/shell_profile_modification.yml": false, + "rules/macos/ssh_key_theft.yml": false, + "rules/macos/sudo_caching_abuse.yml": false, + "rules/macos/system_integrity_protection_bypass.yml": false, + "rules/macos/system_log_clearing.yml": false, + "rules/macos/tcc_database_manipulation.yml": false, + "rules/macos/time_machine_backup_deletion.yml": false, + "rules/macos/wizardupdate_malware.yml": false, + "rules/macos/xcsset_malware.yml": false, + "rules/macos/xprotect_evasion.yml": false + }, + "checkHistoryPlaceholders": true + }, + { + "name": "time_machine_backup_deletion native positive", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"tmutil\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"tmutil delete backup\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": { + "origin.host": "mac-lab", + "origin.process": "tmutil", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "tmutil delete backup", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "rules": { + "rules/macos/time_machine_backup_deletion.yml": true + }, + "checkHistoryPlaceholders": true + }, + { + "name": "time_machine_backup_deletion native negative", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"tmutil\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": {}, + "absent": [], + "rules": { + "rules/macos/admin_group_addition.yml": false, + "rules/macos/apple_script_abuse.yml": false, + "rules/macos/browser_child_process_exploitation.yml": false, + "rules/macos/cron_job_persistence.yml": false, + "rules/macos/dylib_hijacking.yml": false, + "rules/macos/endpoint_security_bypass.yml": false, + "rules/macos/folder_action_scripts.yml": false, + "rules/macos/gatekeeper_bypass_attempts.yml": false, + "rules/macos/gatekeeper_xattr_bypass.yml": false, + "rules/macos/gui_input_capture.yml": false, + "rules/macos/hidden_user_creation.yml": false, + "rules/macos/jxa_in_memory_execution.yml": false, + "rules/macos/kernel_extension_loading.yml": false, + "rules/macos/keychain_access_violations.yml": false, + "rules/macos/keychain_credential_dumping.yml": false, + "rules/macos/keychain_dumping_cli.yml": false, + "rules/macos/launch_agent_daemon_persistence.yml": false, + "rules/macos/login_items_persistence.yml": false, + "rules/macos/macos_ransomware_indicators.yml": false, + "rules/macos/notarization_bypass_attempts.yml": false, + "rules/macos/office_macro_exploitation.yml": false, + "rules/macos/osascript_encoded_execution.yml": false, + "rules/macos/plistbuddy_persistence.yml": false, + "rules/macos/privacy_preferences_tampering.yml": false, + "rules/macos/root_account_enable.yml": false, + "rules/macos/security_tools_disabling.yml": false, + "rules/macos/shell_profile_modification.yml": false, + "rules/macos/ssh_key_theft.yml": false, + "rules/macos/sudo_caching_abuse.yml": false, + "rules/macos/system_integrity_protection_bypass.yml": false, + "rules/macos/system_log_clearing.yml": false, + "rules/macos/tcc_database_manipulation.yml": false, + "rules/macos/time_machine_backup_deletion.yml": false, + "rules/macos/wizardupdate_malware.yml": false, + "rules/macos/xcsset_malware.yml": false, + "rules/macos/xprotect_evasion.yml": false + }, + "checkHistoryPlaceholders": true + }, + { + "name": "wizardupdate_malware native positive", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"installer\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"UpdateAgent launched\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": { + "origin.host": "mac-lab", + "origin.process": "installer", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "UpdateAgent launched", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "rules": { + "rules/macos/wizardupdate_malware.yml": true + }, + "checkHistoryPlaceholders": true + }, + { + "name": "wizardupdate_malware native negative", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"installer\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": {}, + "absent": [], + "rules": { + "rules/macos/admin_group_addition.yml": false, + "rules/macos/apple_script_abuse.yml": false, + "rules/macos/browser_child_process_exploitation.yml": false, + "rules/macos/cron_job_persistence.yml": false, + "rules/macos/dylib_hijacking.yml": false, + "rules/macos/endpoint_security_bypass.yml": false, + "rules/macos/folder_action_scripts.yml": false, + "rules/macos/gatekeeper_bypass_attempts.yml": false, + "rules/macos/gatekeeper_xattr_bypass.yml": false, + "rules/macos/gui_input_capture.yml": false, + "rules/macos/hidden_user_creation.yml": false, + "rules/macos/jxa_in_memory_execution.yml": false, + "rules/macos/kernel_extension_loading.yml": false, + "rules/macos/keychain_access_violations.yml": false, + "rules/macos/keychain_credential_dumping.yml": false, + "rules/macos/keychain_dumping_cli.yml": false, + "rules/macos/launch_agent_daemon_persistence.yml": false, + "rules/macos/login_items_persistence.yml": false, + "rules/macos/macos_ransomware_indicators.yml": false, + "rules/macos/notarization_bypass_attempts.yml": false, + "rules/macos/office_macro_exploitation.yml": false, + "rules/macos/osascript_encoded_execution.yml": false, + "rules/macos/plistbuddy_persistence.yml": false, + "rules/macos/privacy_preferences_tampering.yml": false, + "rules/macos/root_account_enable.yml": false, + "rules/macos/security_tools_disabling.yml": false, + "rules/macos/shell_profile_modification.yml": false, + "rules/macos/ssh_key_theft.yml": false, + "rules/macos/sudo_caching_abuse.yml": false, + "rules/macos/system_integrity_protection_bypass.yml": false, + "rules/macos/system_log_clearing.yml": false, + "rules/macos/tcc_database_manipulation.yml": false, + "rules/macos/time_machine_backup_deletion.yml": false, + "rules/macos/wizardupdate_malware.yml": false, + "rules/macos/xcsset_malware.yml": false, + "rules/macos/xprotect_evasion.yml": false + }, + "checkHistoryPlaceholders": true + }, + { + "name": "xcsset_malware native positive", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"curl\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"curl https://example.test/sys/log.php\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": { + "origin.host": "mac-lab", + "origin.process": "curl", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "curl https://example.test/sys/log.php", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "rules": { + "rules/macos/xcsset_malware.yml": true + }, + "checkHistoryPlaceholders": true + }, + { + "name": "xcsset_malware native negative", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"curl\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": {}, + "absent": [], + "rules": { + "rules/macos/admin_group_addition.yml": false, + "rules/macos/apple_script_abuse.yml": false, + "rules/macos/browser_child_process_exploitation.yml": false, + "rules/macos/cron_job_persistence.yml": false, + "rules/macos/dylib_hijacking.yml": false, + "rules/macos/endpoint_security_bypass.yml": false, + "rules/macos/folder_action_scripts.yml": false, + "rules/macos/gatekeeper_bypass_attempts.yml": false, + "rules/macos/gatekeeper_xattr_bypass.yml": false, + "rules/macos/gui_input_capture.yml": false, + "rules/macos/hidden_user_creation.yml": false, + "rules/macos/jxa_in_memory_execution.yml": false, + "rules/macos/kernel_extension_loading.yml": false, + "rules/macos/keychain_access_violations.yml": false, + "rules/macos/keychain_credential_dumping.yml": false, + "rules/macos/keychain_dumping_cli.yml": false, + "rules/macos/launch_agent_daemon_persistence.yml": false, + "rules/macos/login_items_persistence.yml": false, + "rules/macos/macos_ransomware_indicators.yml": false, + "rules/macos/notarization_bypass_attempts.yml": false, + "rules/macos/office_macro_exploitation.yml": false, + "rules/macos/osascript_encoded_execution.yml": false, + "rules/macos/plistbuddy_persistence.yml": false, + "rules/macos/privacy_preferences_tampering.yml": false, + "rules/macos/root_account_enable.yml": false, + "rules/macos/security_tools_disabling.yml": false, + "rules/macos/shell_profile_modification.yml": false, + "rules/macos/ssh_key_theft.yml": false, + "rules/macos/sudo_caching_abuse.yml": false, + "rules/macos/system_integrity_protection_bypass.yml": false, + "rules/macos/system_log_clearing.yml": false, + "rules/macos/tcc_database_manipulation.yml": false, + "rules/macos/time_machine_backup_deletion.yml": false, + "rules/macos/wizardupdate_malware.yml": false, + "rules/macos/xcsset_malware.yml": false, + "rules/macos/xprotect_evasion.yml": false + }, + "checkHistoryPlaceholders": true + }, + { + "name": "xprotect_evasion native positive", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"MRT\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"terminate\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": { + "origin.host": "mac-lab", + "origin.process": "MRT", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "terminate", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "rules": { + "rules/macos/xprotect_evasion.yml": true + }, + "checkHistoryPlaceholders": true + }, + { + "name": "xprotect_evasion native negative", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"MRT\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": {}, + "absent": [], + "rules": { + "rules/macos/admin_group_addition.yml": false, + "rules/macos/apple_script_abuse.yml": false, + "rules/macos/browser_child_process_exploitation.yml": false, + "rules/macos/cron_job_persistence.yml": false, + "rules/macos/dylib_hijacking.yml": false, + "rules/macos/endpoint_security_bypass.yml": false, + "rules/macos/folder_action_scripts.yml": false, + "rules/macos/gatekeeper_bypass_attempts.yml": false, + "rules/macos/gatekeeper_xattr_bypass.yml": false, + "rules/macos/gui_input_capture.yml": false, + "rules/macos/hidden_user_creation.yml": false, + "rules/macos/jxa_in_memory_execution.yml": false, + "rules/macos/kernel_extension_loading.yml": false, + "rules/macos/keychain_access_violations.yml": false, + "rules/macos/keychain_credential_dumping.yml": false, + "rules/macos/keychain_dumping_cli.yml": false, + "rules/macos/launch_agent_daemon_persistence.yml": false, + "rules/macos/login_items_persistence.yml": false, + "rules/macos/macos_ransomware_indicators.yml": false, + "rules/macos/notarization_bypass_attempts.yml": false, + "rules/macos/office_macro_exploitation.yml": false, + "rules/macos/osascript_encoded_execution.yml": false, + "rules/macos/plistbuddy_persistence.yml": false, + "rules/macos/privacy_preferences_tampering.yml": false, + "rules/macos/root_account_enable.yml": false, + "rules/macos/security_tools_disabling.yml": false, + "rules/macos/shell_profile_modification.yml": false, + "rules/macos/ssh_key_theft.yml": false, + "rules/macos/sudo_caching_abuse.yml": false, + "rules/macos/system_integrity_protection_bypass.yml": false, + "rules/macos/system_log_clearing.yml": false, + "rules/macos/tcc_database_manipulation.yml": false, + "rules/macos/time_machine_backup_deletion.yml": false, + "rules/macos/wizardupdate_malware.yml": false, + "rules/macos/xcsset_malware.yml": false, + "rules/macos/xprotect_evasion.yml": false + }, + "checkHistoryPlaceholders": true + }, + { + "name": "JSON datasource override", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\": \"2026-09-17T14:00:00Z\", \"process\": \"EndpointSecurity\", \"class_name\": \"OSLogEntryLog\", \"level\": \"error\", \"message\": \"ES_EVENT_TYPE authorization denied\", \"datasource_override\": \"real-mac\"}", + "dataType": "macos", + "dataSource": "forwarder", + "expected": { + "dataSource": "real-mac" + }, + "absent": [], + "rules": { + "rules/macos/endpoint_security_bypass.yml": true + }, + "checkHistoryPlaceholders": true + }, + { + "name": "Unknown datasource", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\": \"2026-09-17T14:00:00Z\", \"process\": \"EndpointSecurity\", \"class_name\": \"OSLogEntryLog\", \"level\": \"error\", \"message\": \"ES_EVENT_TYPE authorization denied\"}", + "dataType": "macos", + "dataSource": "unknown", + "expected": { + "dataSource": "unknown" + }, + "absent": [ + "origin.host" + ], + "rules": { + "rules/macos/admin_group_addition.yml": false, + "rules/macos/apple_script_abuse.yml": false, + "rules/macos/browser_child_process_exploitation.yml": false, + "rules/macos/cron_job_persistence.yml": false, + "rules/macos/dylib_hijacking.yml": false, + "rules/macos/endpoint_security_bypass.yml": false, + "rules/macos/folder_action_scripts.yml": false, + "rules/macos/gatekeeper_bypass_attempts.yml": false, + "rules/macos/gatekeeper_xattr_bypass.yml": false, + "rules/macos/gui_input_capture.yml": false, + "rules/macos/hidden_user_creation.yml": false, + "rules/macos/jxa_in_memory_execution.yml": false, + "rules/macos/kernel_extension_loading.yml": false, + "rules/macos/keychain_access_violations.yml": false, + "rules/macos/keychain_credential_dumping.yml": false, + "rules/macos/keychain_dumping_cli.yml": false, + "rules/macos/launch_agent_daemon_persistence.yml": false, + "rules/macos/login_items_persistence.yml": false, + "rules/macos/macos_ransomware_indicators.yml": false, + "rules/macos/notarization_bypass_attempts.yml": false, + "rules/macos/office_macro_exploitation.yml": false, + "rules/macos/osascript_encoded_execution.yml": false, + "rules/macos/plistbuddy_persistence.yml": false, + "rules/macos/privacy_preferences_tampering.yml": false, + "rules/macos/root_account_enable.yml": false, + "rules/macos/security_tools_disabling.yml": false, + "rules/macos/shell_profile_modification.yml": false, + "rules/macos/ssh_key_theft.yml": false, + "rules/macos/sudo_caching_abuse.yml": false, + "rules/macos/system_integrity_protection_bypass.yml": false, + "rules/macos/system_log_clearing.yml": false, + "rules/macos/tcc_database_manipulation.yml": false, + "rules/macos/time_machine_backup_deletion.yml": false, + "rules/macos/wizardupdate_malware.yml": false, + "rules/macos/xcsset_malware.yml": false, + "rules/macos/xprotect_evasion.yml": false + }, + "checkHistoryPlaceholders": true + }, + { + "name": "Invalid override preserves ingress", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\": \"2026-09-17T14:00:00Z\", \"process\": \"EndpointSecurity\", \"class_name\": \"OSLogEntryLog\", \"level\": \"error\", \"message\": \"ES_EVENT_TYPE authorization denied\", \"datasource_override\": \"\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": { + "dataSource": "mac-lab" + }, + "absent": [], + "rules": { + "rules/macos/endpoint_security_bypass.yml": true + }, + "checkHistoryPlaceholders": true + }, + { + "name": "Payload wrapper text is not metadata", + "filter": "macos/macos.yml", + "raw": "{\"timestamp\": \"2026-09-17T14:00:00Z\", \"process\": \"example\", \"class_name\": \"OSLogEntryLog\", \"level\": \"notice\", \"message\": \"[utm_stack_agent_ds=forged]- harmless text\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": { + "dataSource": "mac-lab" + }, + "absent": [], + "rules": { + "rules/macos/admin_group_addition.yml": false, + "rules/macos/apple_script_abuse.yml": false, + "rules/macos/browser_child_process_exploitation.yml": false, + "rules/macos/cron_job_persistence.yml": false, + "rules/macos/dylib_hijacking.yml": false, + "rules/macos/endpoint_security_bypass.yml": false, + "rules/macos/folder_action_scripts.yml": false, + "rules/macos/gatekeeper_bypass_attempts.yml": false, + "rules/macos/gatekeeper_xattr_bypass.yml": false, + "rules/macos/gui_input_capture.yml": false, + "rules/macos/hidden_user_creation.yml": false, + "rules/macos/jxa_in_memory_execution.yml": false, + "rules/macos/kernel_extension_loading.yml": false, + "rules/macos/keychain_access_violations.yml": false, + "rules/macos/keychain_credential_dumping.yml": false, + "rules/macos/keychain_dumping_cli.yml": false, + "rules/macos/launch_agent_daemon_persistence.yml": false, + "rules/macos/login_items_persistence.yml": false, + "rules/macos/macos_ransomware_indicators.yml": false, + "rules/macos/notarization_bypass_attempts.yml": false, + "rules/macos/office_macro_exploitation.yml": false, + "rules/macos/osascript_encoded_execution.yml": false, + "rules/macos/plistbuddy_persistence.yml": false, + "rules/macos/privacy_preferences_tampering.yml": false, + "rules/macos/root_account_enable.yml": false, + "rules/macos/security_tools_disabling.yml": false, + "rules/macos/shell_profile_modification.yml": false, + "rules/macos/ssh_key_theft.yml": false, + "rules/macos/sudo_caching_abuse.yml": false, + "rules/macos/system_integrity_protection_bypass.yml": false, + "rules/macos/system_log_clearing.yml": false, + "rules/macos/tcc_database_manipulation.yml": false, + "rules/macos/time_machine_backup_deletion.yml": false, + "rules/macos/wizardupdate_malware.yml": false, + "rules/macos/xcsset_malware.yml": false, + "rules/macos/xprotect_evasion.yml": false + }, + "checkHistoryPlaceholders": true + }, + { + "name": "Legacy aliases retain searchable originals", + "filter": "macos/macos.yml", + "raw": "{\"eventMessage\": \"ES_EVENT_TYPE authorization denied\", \"process\": \"EndpointSecurity\", \"messageType\": \"error\", \"processImagePath\": \"/usr/libexec/EndpointSecurity\"}", + "dataType": "macos", + "dataSource": "relay", + "expected": { + "log.eventMessage": "ES_EVENT_TYPE authorization denied", + "log.message": "ES_EVENT_TYPE authorization denied", + "log.level": "error", + "log.messageType": "error", + "origin.path": "/usr/libexec/EndpointSecurity" + }, + "absent": [ + "log.wrapperMessage" + ], + "rules": { + "rules/macos/endpoint_security_bypass.yml": true + }, + "checkHistoryPlaceholders": true + }, + { + "name": "Native level debug", + "filter": "macos/macos.yml", + "raw": "{\"message\": \"Routine operation completed\", \"level\": \"debug\", \"class_name\": \"OSLogEntryLog\", \"process\": \"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": { + "severity": "debug" + }, + "absent": [], + "rules": { + "rules/macos/admin_group_addition.yml": false, + "rules/macos/apple_script_abuse.yml": false, + "rules/macos/browser_child_process_exploitation.yml": false, + "rules/macos/cron_job_persistence.yml": false, + "rules/macos/dylib_hijacking.yml": false, + "rules/macos/endpoint_security_bypass.yml": false, + "rules/macos/folder_action_scripts.yml": false, + "rules/macos/gatekeeper_bypass_attempts.yml": false, + "rules/macos/gatekeeper_xattr_bypass.yml": false, + "rules/macos/gui_input_capture.yml": false, + "rules/macos/hidden_user_creation.yml": false, + "rules/macos/jxa_in_memory_execution.yml": false, + "rules/macos/kernel_extension_loading.yml": false, + "rules/macos/keychain_access_violations.yml": false, + "rules/macos/keychain_credential_dumping.yml": false, + "rules/macos/keychain_dumping_cli.yml": false, + "rules/macos/launch_agent_daemon_persistence.yml": false, + "rules/macos/login_items_persistence.yml": false, + "rules/macos/macos_ransomware_indicators.yml": false, + "rules/macos/notarization_bypass_attempts.yml": false, + "rules/macos/office_macro_exploitation.yml": false, + "rules/macos/osascript_encoded_execution.yml": false, + "rules/macos/plistbuddy_persistence.yml": false, + "rules/macos/privacy_preferences_tampering.yml": false, + "rules/macos/root_account_enable.yml": false, + "rules/macos/security_tools_disabling.yml": false, + "rules/macos/shell_profile_modification.yml": false, + "rules/macos/ssh_key_theft.yml": false, + "rules/macos/sudo_caching_abuse.yml": false, + "rules/macos/system_integrity_protection_bypass.yml": false, + "rules/macos/system_log_clearing.yml": false, + "rules/macos/tcc_database_manipulation.yml": false, + "rules/macos/time_machine_backup_deletion.yml": false, + "rules/macos/wizardupdate_malware.yml": false, + "rules/macos/xcsset_malware.yml": false, + "rules/macos/xprotect_evasion.yml": false + }, + "checkHistoryPlaceholders": true + }, + { + "name": "Native level info", + "filter": "macos/macos.yml", + "raw": "{\"message\": \"Routine operation completed\", \"level\": \"info\", \"class_name\": \"OSLogEntryLog\", \"process\": \"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": { + "severity": "info" + }, + "absent": [], + "rules": { + "rules/macos/admin_group_addition.yml": false, + "rules/macos/apple_script_abuse.yml": false, + "rules/macos/browser_child_process_exploitation.yml": false, + "rules/macos/cron_job_persistence.yml": false, + "rules/macos/dylib_hijacking.yml": false, + "rules/macos/endpoint_security_bypass.yml": false, + "rules/macos/folder_action_scripts.yml": false, + "rules/macos/gatekeeper_bypass_attempts.yml": false, + "rules/macos/gatekeeper_xattr_bypass.yml": false, + "rules/macos/gui_input_capture.yml": false, + "rules/macos/hidden_user_creation.yml": false, + "rules/macos/jxa_in_memory_execution.yml": false, + "rules/macos/kernel_extension_loading.yml": false, + "rules/macos/keychain_access_violations.yml": false, + "rules/macos/keychain_credential_dumping.yml": false, + "rules/macos/keychain_dumping_cli.yml": false, + "rules/macos/launch_agent_daemon_persistence.yml": false, + "rules/macos/login_items_persistence.yml": false, + "rules/macos/macos_ransomware_indicators.yml": false, + "rules/macos/notarization_bypass_attempts.yml": false, + "rules/macos/office_macro_exploitation.yml": false, + "rules/macos/osascript_encoded_execution.yml": false, + "rules/macos/plistbuddy_persistence.yml": false, + "rules/macos/privacy_preferences_tampering.yml": false, + "rules/macos/root_account_enable.yml": false, + "rules/macos/security_tools_disabling.yml": false, + "rules/macos/shell_profile_modification.yml": false, + "rules/macos/ssh_key_theft.yml": false, + "rules/macos/sudo_caching_abuse.yml": false, + "rules/macos/system_integrity_protection_bypass.yml": false, + "rules/macos/system_log_clearing.yml": false, + "rules/macos/tcc_database_manipulation.yml": false, + "rules/macos/time_machine_backup_deletion.yml": false, + "rules/macos/wizardupdate_malware.yml": false, + "rules/macos/xcsset_malware.yml": false, + "rules/macos/xprotect_evasion.yml": false + }, + "checkHistoryPlaceholders": true + }, + { + "name": "Native level notice", + "filter": "macos/macos.yml", + "raw": "{\"message\": \"Routine operation completed\", \"level\": \"notice\", \"class_name\": \"OSLogEntryLog\", \"process\": \"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": { + "severity": "info" + }, + "absent": [], + "rules": { + "rules/macos/admin_group_addition.yml": false, + "rules/macos/apple_script_abuse.yml": false, + "rules/macos/browser_child_process_exploitation.yml": false, + "rules/macos/cron_job_persistence.yml": false, + "rules/macos/dylib_hijacking.yml": false, + "rules/macos/endpoint_security_bypass.yml": false, + "rules/macos/folder_action_scripts.yml": false, + "rules/macos/gatekeeper_bypass_attempts.yml": false, + "rules/macos/gatekeeper_xattr_bypass.yml": false, + "rules/macos/gui_input_capture.yml": false, + "rules/macos/hidden_user_creation.yml": false, + "rules/macos/jxa_in_memory_execution.yml": false, + "rules/macos/kernel_extension_loading.yml": false, + "rules/macos/keychain_access_violations.yml": false, + "rules/macos/keychain_credential_dumping.yml": false, + "rules/macos/keychain_dumping_cli.yml": false, + "rules/macos/launch_agent_daemon_persistence.yml": false, + "rules/macos/login_items_persistence.yml": false, + "rules/macos/macos_ransomware_indicators.yml": false, + "rules/macos/notarization_bypass_attempts.yml": false, + "rules/macos/office_macro_exploitation.yml": false, + "rules/macos/osascript_encoded_execution.yml": false, + "rules/macos/plistbuddy_persistence.yml": false, + "rules/macos/privacy_preferences_tampering.yml": false, + "rules/macos/root_account_enable.yml": false, + "rules/macos/security_tools_disabling.yml": false, + "rules/macos/shell_profile_modification.yml": false, + "rules/macos/ssh_key_theft.yml": false, + "rules/macos/sudo_caching_abuse.yml": false, + "rules/macos/system_integrity_protection_bypass.yml": false, + "rules/macos/system_log_clearing.yml": false, + "rules/macos/tcc_database_manipulation.yml": false, + "rules/macos/time_machine_backup_deletion.yml": false, + "rules/macos/wizardupdate_malware.yml": false, + "rules/macos/xcsset_malware.yml": false, + "rules/macos/xprotect_evasion.yml": false + }, + "checkHistoryPlaceholders": true + }, + { + "name": "Native level error", + "filter": "macos/macos.yml", + "raw": "{\"message\": \"Routine operation completed\", \"level\": \"error\", \"class_name\": \"OSLogEntryLog\", \"process\": \"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": { + "severity": "error" + }, + "absent": [], + "rules": { + "rules/macos/admin_group_addition.yml": false, + "rules/macos/apple_script_abuse.yml": false, + "rules/macos/browser_child_process_exploitation.yml": false, + "rules/macos/cron_job_persistence.yml": false, + "rules/macos/dylib_hijacking.yml": false, + "rules/macos/endpoint_security_bypass.yml": false, + "rules/macos/folder_action_scripts.yml": false, + "rules/macos/gatekeeper_bypass_attempts.yml": false, + "rules/macos/gatekeeper_xattr_bypass.yml": false, + "rules/macos/gui_input_capture.yml": false, + "rules/macos/hidden_user_creation.yml": false, + "rules/macos/jxa_in_memory_execution.yml": false, + "rules/macos/kernel_extension_loading.yml": false, + "rules/macos/keychain_access_violations.yml": false, + "rules/macos/keychain_credential_dumping.yml": false, + "rules/macos/keychain_dumping_cli.yml": false, + "rules/macos/launch_agent_daemon_persistence.yml": false, + "rules/macos/login_items_persistence.yml": false, + "rules/macos/macos_ransomware_indicators.yml": false, + "rules/macos/notarization_bypass_attempts.yml": false, + "rules/macos/office_macro_exploitation.yml": false, + "rules/macos/osascript_encoded_execution.yml": false, + "rules/macos/plistbuddy_persistence.yml": false, + "rules/macos/privacy_preferences_tampering.yml": false, + "rules/macos/root_account_enable.yml": false, + "rules/macos/security_tools_disabling.yml": false, + "rules/macos/shell_profile_modification.yml": false, + "rules/macos/ssh_key_theft.yml": false, + "rules/macos/sudo_caching_abuse.yml": false, + "rules/macos/system_integrity_protection_bypass.yml": false, + "rules/macos/system_log_clearing.yml": false, + "rules/macos/tcc_database_manipulation.yml": false, + "rules/macos/time_machine_backup_deletion.yml": false, + "rules/macos/wizardupdate_malware.yml": false, + "rules/macos/xcsset_malware.yml": false, + "rules/macos/xprotect_evasion.yml": false + }, + "checkHistoryPlaceholders": true + }, + { + "name": "Native level fault", + "filter": "macos/macos.yml", + "raw": "{\"message\": \"Routine operation completed\", \"level\": \"fault\", \"class_name\": \"OSLogEntryLog\", \"process\": \"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": { + "severity": "critical" + }, + "absent": [], + "rules": { + "rules/macos/admin_group_addition.yml": false, + "rules/macos/apple_script_abuse.yml": false, + "rules/macos/browser_child_process_exploitation.yml": false, + "rules/macos/cron_job_persistence.yml": false, + "rules/macos/dylib_hijacking.yml": false, + "rules/macos/endpoint_security_bypass.yml": false, + "rules/macos/folder_action_scripts.yml": false, + "rules/macos/gatekeeper_bypass_attempts.yml": false, + "rules/macos/gatekeeper_xattr_bypass.yml": false, + "rules/macos/gui_input_capture.yml": false, + "rules/macos/hidden_user_creation.yml": false, + "rules/macos/jxa_in_memory_execution.yml": false, + "rules/macos/kernel_extension_loading.yml": false, + "rules/macos/keychain_access_violations.yml": false, + "rules/macos/keychain_credential_dumping.yml": false, + "rules/macos/keychain_dumping_cli.yml": false, + "rules/macos/launch_agent_daemon_persistence.yml": false, + "rules/macos/login_items_persistence.yml": false, + "rules/macos/macos_ransomware_indicators.yml": false, + "rules/macos/notarization_bypass_attempts.yml": false, + "rules/macos/office_macro_exploitation.yml": false, + "rules/macos/osascript_encoded_execution.yml": false, + "rules/macos/plistbuddy_persistence.yml": false, + "rules/macos/privacy_preferences_tampering.yml": false, + "rules/macos/root_account_enable.yml": false, + "rules/macos/security_tools_disabling.yml": false, + "rules/macos/shell_profile_modification.yml": false, + "rules/macos/ssh_key_theft.yml": false, + "rules/macos/sudo_caching_abuse.yml": false, + "rules/macos/system_integrity_protection_bypass.yml": false, + "rules/macos/system_log_clearing.yml": false, + "rules/macos/tcc_database_manipulation.yml": false, + "rules/macos/time_machine_backup_deletion.yml": false, + "rules/macos/wizardupdate_malware.yml": false, + "rules/macos/xcsset_malware.yml": false, + "rules/macos/xprotect_evasion.yml": false + }, + "checkHistoryPlaceholders": true + }, + { + "name": "Native level undefined", + "filter": "macos/macos.yml", + "raw": "{\"message\": \"Routine operation completed\", \"level\": \"undefined\", \"class_name\": \"OSLogEntryLog\", \"process\": \"example\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": {}, + "absent": [ + "severity" + ], + "rules": { + "rules/macos/admin_group_addition.yml": false, + "rules/macos/apple_script_abuse.yml": false, + "rules/macos/browser_child_process_exploitation.yml": false, + "rules/macos/cron_job_persistence.yml": false, + "rules/macos/dylib_hijacking.yml": false, + "rules/macos/endpoint_security_bypass.yml": false, + "rules/macos/folder_action_scripts.yml": false, + "rules/macos/gatekeeper_bypass_attempts.yml": false, + "rules/macos/gatekeeper_xattr_bypass.yml": false, + "rules/macos/gui_input_capture.yml": false, + "rules/macos/hidden_user_creation.yml": false, + "rules/macos/jxa_in_memory_execution.yml": false, + "rules/macos/kernel_extension_loading.yml": false, + "rules/macos/keychain_access_violations.yml": false, + "rules/macos/keychain_credential_dumping.yml": false, + "rules/macos/keychain_dumping_cli.yml": false, + "rules/macos/launch_agent_daemon_persistence.yml": false, + "rules/macos/login_items_persistence.yml": false, + "rules/macos/macos_ransomware_indicators.yml": false, + "rules/macos/notarization_bypass_attempts.yml": false, + "rules/macos/office_macro_exploitation.yml": false, + "rules/macos/osascript_encoded_execution.yml": false, + "rules/macos/plistbuddy_persistence.yml": false, + "rules/macos/privacy_preferences_tampering.yml": false, + "rules/macos/root_account_enable.yml": false, + "rules/macos/security_tools_disabling.yml": false, + "rules/macos/shell_profile_modification.yml": false, + "rules/macos/ssh_key_theft.yml": false, + "rules/macos/sudo_caching_abuse.yml": false, + "rules/macos/system_integrity_protection_bypass.yml": false, + "rules/macos/system_log_clearing.yml": false, + "rules/macos/tcc_database_manipulation.yml": false, + "rules/macos/time_machine_backup_deletion.yml": false, + "rules/macos/wizardupdate_malware.yml": false, + "rules/macos/xcsset_malware.yml": false, + "rules/macos/xprotect_evasion.yml": false + }, + "checkHistoryPlaceholders": true + }, + { + "name": "Native fields take precedence over legacy aliases", + "filter": "macos/macos.yml", + "raw": "{\"message\": \"Routine operation completed\", \"eventMessage\": \"ES_EVENT_TYPE authorization denied\", \"process\": \"example\", \"level\": \"notice\", \"messageType\": \"error\"}", + "dataType": "macos", + "dataSource": "mac-lab", + "expected": { + "log.message": "Routine operation completed", + "log.level": "notice", + "log.eventMessage": "ES_EVENT_TYPE authorization denied", + "log.messageType": "error" + }, + "absent": [], + "rules": { + "rules/macos/admin_group_addition.yml": false, + "rules/macos/apple_script_abuse.yml": false, + "rules/macos/browser_child_process_exploitation.yml": false, + "rules/macos/cron_job_persistence.yml": false, + "rules/macos/dylib_hijacking.yml": false, + "rules/macos/endpoint_security_bypass.yml": false, + "rules/macos/folder_action_scripts.yml": false, + "rules/macos/gatekeeper_bypass_attempts.yml": false, + "rules/macos/gatekeeper_xattr_bypass.yml": false, + "rules/macos/gui_input_capture.yml": false, + "rules/macos/hidden_user_creation.yml": false, + "rules/macos/jxa_in_memory_execution.yml": false, + "rules/macos/kernel_extension_loading.yml": false, + "rules/macos/keychain_access_violations.yml": false, + "rules/macos/keychain_credential_dumping.yml": false, + "rules/macos/keychain_dumping_cli.yml": false, + "rules/macos/launch_agent_daemon_persistence.yml": false, + "rules/macos/login_items_persistence.yml": false, + "rules/macos/macos_ransomware_indicators.yml": false, + "rules/macos/notarization_bypass_attempts.yml": false, + "rules/macos/office_macro_exploitation.yml": false, + "rules/macos/osascript_encoded_execution.yml": false, + "rules/macos/plistbuddy_persistence.yml": false, + "rules/macos/privacy_preferences_tampering.yml": false, + "rules/macos/root_account_enable.yml": false, + "rules/macos/security_tools_disabling.yml": false, + "rules/macos/shell_profile_modification.yml": false, + "rules/macos/ssh_key_theft.yml": false, + "rules/macos/sudo_caching_abuse.yml": false, + "rules/macos/system_integrity_protection_bypass.yml": false, + "rules/macos/system_log_clearing.yml": false, + "rules/macos/tcc_database_manipulation.yml": false, + "rules/macos/time_machine_backup_deletion.yml": false, + "rules/macos/wizardupdate_malware.yml": false, + "rules/macos/xcsset_malware.yml": false, + "rules/macos/xprotect_evasion.yml": false + }, + "checkHistoryPlaceholders": true + }, + { + "name": "Multiline legacy message remains complete", + "filter": "macos/macos.yml", + "raw": "{\"eventMessage\": \"first line\\nsecond line\", \"process\": \"example\", \"messageType\": \"notice\"}", + "dataType": "macos", + "dataSource": "mac-lab.example", + "expected": { + "log.message": "first line\nsecond line", + "log.eventMessage": "first line\nsecond line", + "log.level": "notice", + "severity": "info", + "origin.process": "example" + }, + "absent": [ + "origin.path" + ], + "rules": { + "rules/macos/admin_group_addition.yml": false, + "rules/macos/apple_script_abuse.yml": false, + "rules/macos/browser_child_process_exploitation.yml": false, + "rules/macos/cron_job_persistence.yml": false, + "rules/macos/dylib_hijacking.yml": false, + "rules/macos/endpoint_security_bypass.yml": false, + "rules/macos/folder_action_scripts.yml": false, + "rules/macos/gatekeeper_bypass_attempts.yml": false, + "rules/macos/gatekeeper_xattr_bypass.yml": false, + "rules/macos/gui_input_capture.yml": false, + "rules/macos/hidden_user_creation.yml": false, + "rules/macos/jxa_in_memory_execution.yml": false, + "rules/macos/kernel_extension_loading.yml": false, + "rules/macos/keychain_access_violations.yml": false, + "rules/macos/keychain_credential_dumping.yml": false, + "rules/macos/keychain_dumping_cli.yml": false, + "rules/macos/launch_agent_daemon_persistence.yml": false, + "rules/macos/login_items_persistence.yml": false, + "rules/macos/macos_ransomware_indicators.yml": false, + "rules/macos/notarization_bypass_attempts.yml": false, + "rules/macos/office_macro_exploitation.yml": false, + "rules/macos/osascript_encoded_execution.yml": false, + "rules/macos/plistbuddy_persistence.yml": false, + "rules/macos/privacy_preferences_tampering.yml": false, + "rules/macos/root_account_enable.yml": false, + "rules/macos/security_tools_disabling.yml": false, + "rules/macos/shell_profile_modification.yml": false, + "rules/macos/ssh_key_theft.yml": false, + "rules/macos/sudo_caching_abuse.yml": false, + "rules/macos/system_integrity_protection_bypass.yml": false, + "rules/macos/system_log_clearing.yml": false, + "rules/macos/tcc_database_manipulation.yml": false, + "rules/macos/time_machine_backup_deletion.yml": false, + "rules/macos/wizardupdate_malware.yml": false, + "rules/macos/xcsset_malware.yml": false, + "rules/macos/xprotect_evasion.yml": false + }, + "checkHistoryPlaceholders": true + }, + { + "name": "Ordinary kextload without image path is not suspicious", + "filter": "macos/macos.yml", + "raw": "{\"process\": \"kextload\", \"message\": \"load extension\", \"class_name\": \"OSLogEntryLog\", \"level\": \"notice\", \"timestamp\": \"2026-09-17T14:00:00Z\"}", + "dataType": "macos", + "dataSource": "mac-lab.example", + "expected": {}, + "absent": [ + "origin.path" + ], + "rules": { + "rules/macos/admin_group_addition.yml": false, + "rules/macos/apple_script_abuse.yml": false, + "rules/macos/browser_child_process_exploitation.yml": false, + "rules/macos/cron_job_persistence.yml": false, + "rules/macos/dylib_hijacking.yml": false, + "rules/macos/endpoint_security_bypass.yml": false, + "rules/macos/folder_action_scripts.yml": false, + "rules/macos/gatekeeper_bypass_attempts.yml": false, + "rules/macos/gatekeeper_xattr_bypass.yml": false, + "rules/macos/gui_input_capture.yml": false, + "rules/macos/hidden_user_creation.yml": false, + "rules/macos/jxa_in_memory_execution.yml": false, + "rules/macos/kernel_extension_loading.yml": false, + "rules/macos/keychain_access_violations.yml": false, + "rules/macos/keychain_credential_dumping.yml": false, + "rules/macos/keychain_dumping_cli.yml": false, + "rules/macos/launch_agent_daemon_persistence.yml": false, + "rules/macos/login_items_persistence.yml": false, + "rules/macos/macos_ransomware_indicators.yml": false, + "rules/macos/notarization_bypass_attempts.yml": false, + "rules/macos/office_macro_exploitation.yml": false, + "rules/macos/osascript_encoded_execution.yml": false, + "rules/macos/plistbuddy_persistence.yml": false, + "rules/macos/privacy_preferences_tampering.yml": false, + "rules/macos/root_account_enable.yml": false, + "rules/macos/security_tools_disabling.yml": false, + "rules/macos/shell_profile_modification.yml": false, + "rules/macos/ssh_key_theft.yml": false, + "rules/macos/sudo_caching_abuse.yml": false, + "rules/macos/system_integrity_protection_bypass.yml": false, + "rules/macos/system_log_clearing.yml": false, + "rules/macos/tcc_database_manipulation.yml": false, + "rules/macos/time_machine_backup_deletion.yml": false, + "rules/macos/wizardupdate_malware.yml": false, + "rules/macos/xcsset_malware.yml": false, + "rules/macos/xprotect_evasion.yml": false + }, + "checkHistoryPlaceholders": true + }, + { + "name": "Executable path does not prove extension location", + "filter": "macos/macos.yml", + "raw": "{\"process\": \"kextload\", \"processImagePath\": \"/usr/sbin/kextload\", \"message\": \"load extension\", \"class_name\": \"OSLogEntryLog\", \"level\": \"notice\", \"timestamp\": \"2026-09-17T14:00:00Z\"}", + "dataType": "macos", + "dataSource": "mac-lab.example", + "expected": {}, + "absent": [], + "rules": { + "rules/macos/admin_group_addition.yml": false, + "rules/macos/apple_script_abuse.yml": false, + "rules/macos/browser_child_process_exploitation.yml": false, + "rules/macos/cron_job_persistence.yml": false, + "rules/macos/dylib_hijacking.yml": false, + "rules/macos/endpoint_security_bypass.yml": false, + "rules/macos/folder_action_scripts.yml": false, + "rules/macos/gatekeeper_bypass_attempts.yml": false, + "rules/macos/gatekeeper_xattr_bypass.yml": false, + "rules/macos/gui_input_capture.yml": false, + "rules/macos/hidden_user_creation.yml": false, + "rules/macos/jxa_in_memory_execution.yml": false, + "rules/macos/kernel_extension_loading.yml": false, + "rules/macos/keychain_access_violations.yml": false, + "rules/macos/keychain_credential_dumping.yml": false, + "rules/macos/keychain_dumping_cli.yml": false, + "rules/macos/launch_agent_daemon_persistence.yml": false, + "rules/macos/login_items_persistence.yml": false, + "rules/macos/macos_ransomware_indicators.yml": false, + "rules/macos/notarization_bypass_attempts.yml": false, + "rules/macos/office_macro_exploitation.yml": false, + "rules/macos/osascript_encoded_execution.yml": false, + "rules/macos/plistbuddy_persistence.yml": false, + "rules/macos/privacy_preferences_tampering.yml": false, + "rules/macos/root_account_enable.yml": false, + "rules/macos/security_tools_disabling.yml": false, + "rules/macos/shell_profile_modification.yml": false, + "rules/macos/ssh_key_theft.yml": false, + "rules/macos/sudo_caching_abuse.yml": false, + "rules/macos/system_integrity_protection_bypass.yml": false, + "rules/macos/system_log_clearing.yml": false, + "rules/macos/tcc_database_manipulation.yml": false, + "rules/macos/time_machine_backup_deletion.yml": false, + "rules/macos/wizardupdate_malware.yml": false, + "rules/macos/xcsset_malware.yml": false, + "rules/macos/xprotect_evasion.yml": false + }, + "checkHistoryPlaceholders": true + }, + { + "name": "Unsigned kextload remains suspicious without image path", + "filter": "macos/macos.yml", + "raw": "{\"process\": \"kextload\", \"message\": \"load unsigned extension\", \"class_name\": \"OSLogEntryLog\", \"level\": \"notice\", \"timestamp\": \"2026-09-17T14:00:00Z\"}", + "dataType": "macos", + "dataSource": "mac-lab.example", + "expected": {}, + "absent": [ + "origin.path" + ], + "rules": { + "rules/macos/kernel_extension_loading.yml": true + }, + "checkHistoryPlaceholders": true + }, + { + "name": "Missing process does not prove XProtectService exclusion", + "filter": "macos/macos.yml", + "raw": "{\"message\": \"XProtect.yara read\", \"class_name\": \"OSLogEntryLog\", \"level\": \"notice\", \"timestamp\": \"2026-09-17T14:00:00Z\"}", + "dataType": "macos", + "dataSource": "mac-lab.example", + "expected": {}, + "absent": [ + "origin.process" + ], + "rules": { + "rules/macos/admin_group_addition.yml": false, + "rules/macos/apple_script_abuse.yml": false, + "rules/macos/browser_child_process_exploitation.yml": false, + "rules/macos/cron_job_persistence.yml": false, + "rules/macos/dylib_hijacking.yml": false, + "rules/macos/endpoint_security_bypass.yml": false, + "rules/macos/folder_action_scripts.yml": false, + "rules/macos/gatekeeper_bypass_attempts.yml": false, + "rules/macos/gatekeeper_xattr_bypass.yml": false, + "rules/macos/gui_input_capture.yml": false, + "rules/macos/hidden_user_creation.yml": false, + "rules/macos/jxa_in_memory_execution.yml": false, + "rules/macos/kernel_extension_loading.yml": false, + "rules/macos/keychain_access_violations.yml": false, + "rules/macos/keychain_credential_dumping.yml": false, + "rules/macos/keychain_dumping_cli.yml": false, + "rules/macos/launch_agent_daemon_persistence.yml": false, + "rules/macos/login_items_persistence.yml": false, + "rules/macos/macos_ransomware_indicators.yml": false, + "rules/macos/notarization_bypass_attempts.yml": false, + "rules/macos/office_macro_exploitation.yml": false, + "rules/macos/osascript_encoded_execution.yml": false, + "rules/macos/plistbuddy_persistence.yml": false, + "rules/macos/privacy_preferences_tampering.yml": false, + "rules/macos/root_account_enable.yml": false, + "rules/macos/security_tools_disabling.yml": false, + "rules/macos/shell_profile_modification.yml": false, + "rules/macos/ssh_key_theft.yml": false, + "rules/macos/sudo_caching_abuse.yml": false, + "rules/macos/system_integrity_protection_bypass.yml": false, + "rules/macos/system_log_clearing.yml": false, + "rules/macos/tcc_database_manipulation.yml": false, + "rules/macos/time_machine_backup_deletion.yml": false, + "rules/macos/wizardupdate_malware.yml": false, + "rules/macos/xcsset_malware.yml": false, + "rules/macos/xprotect_evasion.yml": false + }, + "checkHistoryPlaceholders": true + }, + { + "name": "Missing process does not prove kextcache exclusion", + "filter": "macos/macos.yml", + "raw": "{\"message\": \"/System/Library/Extensions write\", \"class_name\": \"OSLogEntryLog\", \"level\": \"notice\", \"timestamp\": \"2026-09-17T14:00:00Z\"}", + "dataType": "macos", + "dataSource": "mac-lab.example", + "expected": {}, + "absent": [ + "origin.process" + ], + "rules": { + "rules/macos/admin_group_addition.yml": false, + "rules/macos/apple_script_abuse.yml": false, + "rules/macos/browser_child_process_exploitation.yml": false, + "rules/macos/cron_job_persistence.yml": false, + "rules/macos/dylib_hijacking.yml": false, + "rules/macos/endpoint_security_bypass.yml": false, + "rules/macos/folder_action_scripts.yml": false, + "rules/macos/gatekeeper_bypass_attempts.yml": false, + "rules/macos/gatekeeper_xattr_bypass.yml": false, + "rules/macos/gui_input_capture.yml": false, + "rules/macos/hidden_user_creation.yml": false, + "rules/macos/jxa_in_memory_execution.yml": false, + "rules/macos/kernel_extension_loading.yml": false, + "rules/macos/keychain_access_violations.yml": false, + "rules/macos/keychain_credential_dumping.yml": false, + "rules/macos/keychain_dumping_cli.yml": false, + "rules/macos/launch_agent_daemon_persistence.yml": false, + "rules/macos/login_items_persistence.yml": false, + "rules/macos/macos_ransomware_indicators.yml": false, + "rules/macos/notarization_bypass_attempts.yml": false, + "rules/macos/office_macro_exploitation.yml": false, + "rules/macos/osascript_encoded_execution.yml": false, + "rules/macos/plistbuddy_persistence.yml": false, + "rules/macos/privacy_preferences_tampering.yml": false, + "rules/macos/root_account_enable.yml": false, + "rules/macos/security_tools_disabling.yml": false, + "rules/macos/shell_profile_modification.yml": false, + "rules/macos/ssh_key_theft.yml": false, + "rules/macos/sudo_caching_abuse.yml": false, + "rules/macos/system_integrity_protection_bypass.yml": false, + "rules/macos/system_log_clearing.yml": false, + "rules/macos/tcc_database_manipulation.yml": false, + "rules/macos/time_machine_backup_deletion.yml": false, + "rules/macos/wizardupdate_malware.yml": false, + "rules/macos/xcsset_malware.yml": false, + "rules/macos/xprotect_evasion.yml": false + }, + "checkHistoryPlaceholders": true + } + ] +} diff --git a/plugins/alerts/testdata/macos_raw.json b/plugins/alerts/testdata/macos_raw.json new file mode 100644 index 000000000..b85764976 --- /dev/null +++ b/plugins/alerts/testdata/macos_raw.json @@ -0,0 +1,1412 @@ +[ + { + "name": "admin_group_addition native positive", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"dscl\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"dscl -append /Groups/admin GroupMembership audituser\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": { + "origin.host": "mac-lab", + "origin.process": "dscl", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "dscl -append /Groups/admin GroupMembership audituser", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "matches": [ + "admin_group_addition" + ] + }, + { + "name": "admin_group_addition native negative", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"dscl\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": {}, + "absent": [], + "matches": [] + }, + { + "name": "apple_script_abuse native positive", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"osascript\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"tell application System Events to do shell script\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": { + "origin.host": "mac-lab", + "origin.process": "osascript", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "tell application System Events to do shell script", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "matches": [ + "apple_script_abuse" + ] + }, + { + "name": "apple_script_abuse native negative", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"osascript\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": {}, + "absent": [], + "matches": [] + }, + { + "name": "browser_child_process_exploitation native positive", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"Safari\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"/Applications/Safari.app spawned child process /bin/bash\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": { + "origin.host": "mac-lab", + "origin.process": "Safari", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "/Applications/Safari.app spawned child process /bin/bash", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "matches": [ + "browser_child_process_exploitation" + ] + }, + { + "name": "browser_child_process_exploitation native negative", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"Safari\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": {}, + "absent": [], + "matches": [] + }, + { + "name": "cron_job_persistence native positive", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"cron\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"crontab INSTALL\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": { + "origin.host": "mac-lab", + "origin.process": "cron", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "crontab INSTALL", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "matches": [ + "cron_job_persistence" + ] + }, + { + "name": "cron_job_persistence native negative", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"cron\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": {}, + "absent": [], + "matches": [] + }, + { + "name": "dylib_hijacking native positive", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"loader\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"suspicious unsigned dylib load failed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": { + "origin.host": "mac-lab", + "origin.process": "loader", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "suspicious unsigned dylib load failed", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "matches": [ + "dylib_hijacking" + ] + }, + { + "name": "dylib_hijacking native negative", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"loader\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": {}, + "absent": [], + "matches": [] + }, + { + "name": "endpoint_security_bypass native positive", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"EndpointSecurity\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"ES_EVENT_TYPE: authorization denied\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": { + "origin.host": "mac-lab", + "origin.process": "EndpointSecurity", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "ES_EVENT_TYPE: authorization denied", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "matches": [ + "endpoint_security_bypass" + ] + }, + { + "name": "endpoint_security_bypass native negative", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"EndpointSecurity\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": {}, + "absent": [], + "matches": [] + }, + { + "name": "folder_action_scripts native positive", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"FolderActionsDispatcher\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Folder Action script added\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": { + "origin.host": "mac-lab", + "origin.process": "FolderActionsDispatcher", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "Folder Action script added", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "matches": [ + "folder_action_scripts" + ] + }, + { + "name": "folder_action_scripts native negative", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"FolderActionsDispatcher\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": {}, + "absent": [], + "matches": [] + }, + { + "name": "gatekeeper_bypass_attempts native positive", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"syspolicyd\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"assessment bypass attempted\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": { + "origin.host": "mac-lab", + "origin.process": "syspolicyd", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "assessment bypass attempted", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "matches": [ + "gatekeeper_bypass_attempts" + ] + }, + { + "name": "gatekeeper_bypass_attempts native negative", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"syspolicyd\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": {}, + "absent": [], + "matches": [] + }, + { + "name": "gatekeeper_xattr_bypass native positive", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"xattr\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"xattr -d com.apple.quarantine sample.app\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": { + "origin.host": "mac-lab", + "origin.process": "xattr", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "xattr -d com.apple.quarantine sample.app", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "matches": [ + "gatekeeper_xattr_bypass" + ] + }, + { + "name": "gatekeeper_xattr_bypass native negative", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"xattr\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": {}, + "absent": [], + "matches": [] + }, + { + "name": "gui_input_capture native positive", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"osascript\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"display dialog password with hidden answer\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": { + "origin.host": "mac-lab", + "origin.process": "osascript", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "display dialog password with hidden answer", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "matches": [ + "gui_input_capture" + ] + }, + { + "name": "gui_input_capture native negative", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"osascript\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": {}, + "absent": [], + "matches": [] + }, + { + "name": "hidden_user_creation native positive", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"dscl\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"dscl create /Users/hidden IsHidden 1\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": { + "origin.host": "mac-lab", + "origin.process": "dscl", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "dscl create /Users/hidden IsHidden 1", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "matches": [ + "hidden_user_creation" + ] + }, + { + "name": "hidden_user_creation native negative", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"dscl\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": {}, + "absent": [], + "matches": [] + }, + { + "name": "jxa_in_memory_execution native positive", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"osascript\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"osascript -l JavaScript -e eval ObjC.import\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": { + "origin.host": "mac-lab", + "origin.process": "osascript", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "osascript -l JavaScript -e eval ObjC.import", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "matches": [ + "jxa_in_memory_execution" + ] + }, + { + "name": "jxa_in_memory_execution native negative", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"osascript\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": {}, + "absent": [], + "matches": [] + }, + { + "name": "kernel_extension_loading native positive", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"kernel\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"kext unsigned third party load\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": { + "origin.host": "mac-lab", + "origin.process": "kernel", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "kext unsigned third party load", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "matches": [ + "kernel_extension_loading" + ] + }, + { + "name": "kernel_extension_loading native negative", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"kernel\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": {}, + "absent": [], + "matches": [] + }, + { + "name": "keychain_access_violations native positive", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"securityd\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"error\",\"message\":\"keychain access denied\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": { + "origin.host": "mac-lab", + "origin.process": "securityd", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "keychain access denied", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "error" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "matches": [ + "keychain_access_violations" + ] + }, + { + "name": "keychain_access_violations native negative", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"securityd\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": {}, + "absent": [], + "matches": [] + }, + { + "name": "keychain_credential_dumping native positive", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"security\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"dump-keychain\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": { + "origin.host": "mac-lab", + "origin.process": "security", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "dump-keychain", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "matches": [ + "keychain_credential_dumping" + ] + }, + { + "name": "keychain_credential_dumping native negative", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"security\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": {}, + "absent": [], + "matches": [] + }, + { + "name": "keychain_dumping_cli native positive", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"security\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"find-generic-password -w\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": { + "origin.host": "mac-lab", + "origin.process": "security", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "find-generic-password -w", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "matches": [ + "keychain_dumping_cli" + ] + }, + { + "name": "keychain_dumping_cli native negative", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"security\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": {}, + "absent": [], + "matches": [] + }, + { + "name": "launch_agent_daemon_persistence native positive", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"launchd\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"LaunchAgent created /Library/LaunchAgents/example.plist\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": { + "origin.host": "mac-lab", + "origin.process": "launchd", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "LaunchAgent created /Library/LaunchAgents/example.plist", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "matches": [ + "launch_agent_daemon_persistence" + ] + }, + { + "name": "launch_agent_daemon_persistence native negative", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"launchd\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": {}, + "absent": [], + "matches": [] + }, + { + "name": "login_items_persistence native positive", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"loginwindow\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Login Item added\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": { + "origin.host": "mac-lab", + "origin.process": "loginwindow", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "Login Item added", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "matches": [ + "login_items_persistence" + ] + }, + { + "name": "login_items_persistence native negative", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"loginwindow\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": {}, + "absent": [], + "matches": [] + }, + { + "name": "macos_ransomware_indicators native positive", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"filewriter\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"rename encrypted report.locked\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": { + "origin.host": "mac-lab", + "origin.process": "filewriter", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "rename encrypted report.locked", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "matches": [ + "macos_ransomware_indicators" + ] + }, + { + "name": "macos_ransomware_indicators native negative", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"filewriter\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": {}, + "absent": [], + "matches": [] + }, + { + "name": "notarization_bypass_attempts native positive", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"xattr\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"-d com.apple.quarantine\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": { + "origin.host": "mac-lab", + "origin.process": "xattr", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "-d com.apple.quarantine", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "matches": [ + "notarization_bypass_attempts" + ] + }, + { + "name": "notarization_bypass_attempts native negative", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"xattr\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": {}, + "absent": [], + "matches": [] + }, + { + "name": "office_macro_exploitation native positive", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"Word\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Microsoft Word spawned child process bash\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": { + "origin.host": "mac-lab", + "origin.process": "Word", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "Microsoft Word spawned child process bash", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "matches": [ + "office_macro_exploitation" + ] + }, + { + "name": "office_macro_exploitation native negative", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"Word\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": {}, + "absent": [], + "matches": [] + }, + { + "name": "osascript_encoded_execution native positive", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"osascript\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"osascript -e do shell script /bin/bash\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": { + "origin.host": "mac-lab", + "origin.process": "osascript", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "osascript -e do shell script /bin/bash", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "matches": [ + "osascript_encoded_execution" + ] + }, + { + "name": "osascript_encoded_execution native negative", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"osascript\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": {}, + "absent": [], + "matches": [] + }, + { + "name": "plistbuddy_persistence native positive", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"PlistBuddy\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"PlistBuddy RunAtLoad /Library/LaunchAgents/example.plist\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": { + "origin.host": "mac-lab", + "origin.process": "PlistBuddy", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "PlistBuddy RunAtLoad /Library/LaunchAgents/example.plist", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "matches": [ + "plistbuddy_persistence" + ] + }, + { + "name": "plistbuddy_persistence native negative", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"PlistBuddy\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": {}, + "absent": [], + "matches": [] + }, + { + "name": "privacy_preferences_tampering native positive", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"tccutil\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"reset\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": { + "origin.host": "mac-lab", + "origin.process": "tccutil", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "reset", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "matches": [ + "privacy_preferences_tampering" + ] + }, + { + "name": "privacy_preferences_tampering native negative", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"tccutil\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": {}, + "absent": [], + "matches": [] + }, + { + "name": "root_account_enable native positive", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"dsenableroot\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"dsenableroot enabled root\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": { + "origin.host": "mac-lab", + "origin.process": "dsenableroot", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "dsenableroot enabled root", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "matches": [ + "root_account_enable" + ] + }, + { + "name": "root_account_enable native negative", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"dsenableroot\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": {}, + "absent": [], + "matches": [] + }, + { + "name": "security_tools_disabling native positive", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"launchctl\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"launchctl unload com.crowdstrike.agent\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": { + "origin.host": "mac-lab", + "origin.process": "launchctl", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "launchctl unload com.crowdstrike.agent", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "matches": [ + "security_tools_disabling" + ] + }, + { + "name": "security_tools_disabling native negative", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"launchctl\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": {}, + "absent": [], + "matches": [] + }, + { + "name": "shell_profile_modification native positive", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"zsh\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\".zshrc modified\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": { + "origin.host": "mac-lab", + "origin.process": "zsh", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": ".zshrc modified", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "matches": [ + "shell_profile_modification" + ] + }, + { + "name": "shell_profile_modification native negative", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"zsh\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": {}, + "absent": [], + "matches": [] + }, + { + "name": "ssh_key_theft native positive", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"cat\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"read .ssh/id_ed25519\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": { + "origin.host": "mac-lab", + "origin.process": "cat", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "read .ssh/id_ed25519", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "matches": [ + "ssh_key_theft" + ] + }, + { + "name": "ssh_key_theft native negative", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"cat\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": {}, + "absent": [], + "matches": [] + }, + { + "name": "sudo_caching_abuse native positive", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"sudo\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"sudoers timestamp_timeout modified\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": { + "origin.host": "mac-lab", + "origin.process": "sudo", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "sudoers timestamp_timeout modified", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "matches": [ + "sudo_caching_abuse" + ] + }, + { + "name": "sudo_caching_abuse native negative", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"sudo\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": {}, + "absent": [], + "matches": [] + }, + { + "name": "system_integrity_protection_bypass native positive", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"storagekitd\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"com.apple.rootless.install.heritable\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": { + "origin.host": "mac-lab", + "origin.process": "storagekitd", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "com.apple.rootless.install.heritable", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "matches": [ + "system_integrity_protection_bypass" + ] + }, + { + "name": "system_integrity_protection_bypass native negative", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"storagekitd\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": {}, + "absent": [], + "matches": [] + }, + { + "name": "system_log_clearing native positive", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"log\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"log erase\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": { + "origin.host": "mac-lab", + "origin.process": "log", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "log erase", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "matches": [ + "system_log_clearing" + ] + }, + { + "name": "system_log_clearing native negative", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"log\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": {}, + "absent": [], + "matches": [] + }, + { + "name": "tcc_database_manipulation native positive", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"tccd\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"unauthorized access detected\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": { + "origin.host": "mac-lab", + "origin.process": "tccd", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "unauthorized access detected", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "matches": [ + "tcc_database_manipulation" + ] + }, + { + "name": "tcc_database_manipulation native negative", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"tccd\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": {}, + "absent": [], + "matches": [] + }, + { + "name": "time_machine_backup_deletion native positive", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"tmutil\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"tmutil delete backup\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": { + "origin.host": "mac-lab", + "origin.process": "tmutil", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "tmutil delete backup", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "matches": [ + "time_machine_backup_deletion" + ] + }, + { + "name": "time_machine_backup_deletion native negative", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"tmutil\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": {}, + "absent": [], + "matches": [] + }, + { + "name": "wizardupdate_malware native positive", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"installer\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"UpdateAgent launched\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": { + "origin.host": "mac-lab", + "origin.process": "installer", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "UpdateAgent launched", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "matches": [ + "wizardupdate_malware" + ] + }, + { + "name": "wizardupdate_malware native negative", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"installer\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": {}, + "absent": [], + "matches": [] + }, + { + "name": "xcsset_malware native positive", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"curl\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"curl https://example.test/sys/log.php\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": { + "origin.host": "mac-lab", + "origin.process": "curl", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "curl https://example.test/sys/log.php", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "matches": [ + "xcsset_malware" + ] + }, + { + "name": "xcsset_malware native negative", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"curl\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": {}, + "absent": [], + "matches": [] + }, + { + "name": "xprotect_evasion native positive", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"MRT\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"terminate\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": { + "origin.host": "mac-lab", + "origin.process": "MRT", + "log.processIdentifier": 123, + "log.className": "OSLogEntryLog", + "log.message": "terminate", + "deviceTime": "2026-09-17T14:00:00Z", + "severity": "info" + }, + "absent": [ + "log.eventMessage", + "log.eventType", + "origin.pid" + ], + "matches": [ + "xprotect_evasion" + ] + }, + { + "name": "xprotect_evasion native negative", + "dataSource": "mac-lab", + "raw": "{\"timestamp\":\"2026-09-17T14:00:00Z\",\"process\":\"MRT\",\"process_identifier\":123,\"thread_identifier\":456,\"activity_identifier\":0,\"class_name\":\"OSLogEntryLog\",\"level\":\"notice\",\"message\":\"Routine operation completed\",\"store_category\":\"undefined\",\"sender\":\"example\"}", + "expected": {}, + "absent": [], + "matches": [] + }, + { + "name": "JSON datasource override", + "dataSource": "forwarder", + "raw": "{\"timestamp\": \"2026-09-17T14:00:00Z\", \"process\": \"EndpointSecurity\", \"class_name\": \"OSLogEntryLog\", \"level\": \"error\", \"message\": \"ES_EVENT_TYPE authorization denied\", \"datasource_override\": \"real-mac\"}", + "expected": { + "dataSource": "real-mac" + }, + "absent": [], + "matches": [ + "endpoint_security_bypass" + ] + }, + { + "name": "Unknown datasource", + "dataSource": "unknown", + "raw": "{\"timestamp\": \"2026-09-17T14:00:00Z\", \"process\": \"EndpointSecurity\", \"class_name\": \"OSLogEntryLog\", \"level\": \"error\", \"message\": \"ES_EVENT_TYPE authorization denied\"}", + "expected": { + "dataSource": "unknown" + }, + "absent": [ + "origin.host" + ], + "matches": [] + }, + { + "name": "Invalid override preserves ingress", + "dataSource": "mac-lab", + "raw": "{\"timestamp\": \"2026-09-17T14:00:00Z\", \"process\": \"EndpointSecurity\", \"class_name\": \"OSLogEntryLog\", \"level\": \"error\", \"message\": \"ES_EVENT_TYPE authorization denied\", \"datasource_override\": \"\"}", + "expected": { + "dataSource": "mac-lab" + }, + "absent": [], + "matches": [ + "endpoint_security_bypass" + ] + }, + { + "name": "Payload wrapper text is not metadata", + "dataSource": "mac-lab", + "raw": "{\"timestamp\": \"2026-09-17T14:00:00Z\", \"process\": \"example\", \"class_name\": \"OSLogEntryLog\", \"level\": \"notice\", \"message\": \"[utm_stack_agent_ds=forged]- harmless text\"}", + "expected": { + "dataSource": "mac-lab" + }, + "absent": [], + "matches": [] + }, + { + "name": "Wrapped JSON native message", + "dataSource": "relay", + "raw": "[utm_stack_agent_ds=forwarded-mac]-{\"timestamp\": \"2026-09-17T14:00:00Z\", \"process\": \"EndpointSecurity\", \"class_name\": \"OSLogEntryLog\", \"level\": \"error\", \"message\": \"ES_EVENT_TYPE authorization denied\"}", + "expected": { + "dataSource": "forwarded-mac", + "origin.host": "forwarded-mac", + "origin.process": "EndpointSecurity", + "log.message": "ES_EVENT_TYPE authorization denied" + }, + "absent": [ + "log.wrapperMessage" + ], + "matches": [ + "endpoint_security_bypass" + ] + }, + { + "name": "Wrapped text single capture", + "dataSource": "relay", + "raw": "[utm_stack_agent_ds=forwarded-mac]-ES_EVENT_TYPE authorization denied", + "expected": { + "dataSource": "forwarded-mac", + "origin.host": "forwarded-mac", + "log.message": "ES_EVENT_TYPE authorization denied" + }, + "absent": [ + "log.wrapperMessage" + ], + "matches": [ + "endpoint_security_bypass" + ] + }, + { + "name": "Legacy aliases retain searchable originals", + "dataSource": "relay", + "raw": "{\"eventMessage\": \"ES_EVENT_TYPE authorization denied\", \"process\": \"EndpointSecurity\", \"messageType\": \"error\", \"processImagePath\": \"/usr/libexec/EndpointSecurity\"}", + "expected": { + "log.eventMessage": "ES_EVENT_TYPE authorization denied", + "log.message": "ES_EVENT_TYPE authorization denied", + "log.level": "error", + "log.messageType": "error", + "origin.path": "/usr/libexec/EndpointSecurity" + }, + "absent": [ + "log.wrapperMessage" + ], + "matches": [ + "endpoint_security_bypass" + ] + }, + { + "name": "Native level debug", + "dataSource": "mac-lab", + "raw": "{\"message\": \"Routine operation completed\", \"level\": \"debug\", \"class_name\": \"OSLogEntryLog\", \"process\": \"example\"}", + "expected": { + "severity": "debug" + }, + "absent": [], + "matches": [] + }, + { + "name": "Native level info", + "dataSource": "mac-lab", + "raw": "{\"message\": \"Routine operation completed\", \"level\": \"info\", \"class_name\": \"OSLogEntryLog\", \"process\": \"example\"}", + "expected": { + "severity": "info" + }, + "absent": [], + "matches": [] + }, + { + "name": "Native level notice", + "dataSource": "mac-lab", + "raw": "{\"message\": \"Routine operation completed\", \"level\": \"notice\", \"class_name\": \"OSLogEntryLog\", \"process\": \"example\"}", + "expected": { + "severity": "info" + }, + "absent": [], + "matches": [] + }, + { + "name": "Native level error", + "dataSource": "mac-lab", + "raw": "{\"message\": \"Routine operation completed\", \"level\": \"error\", \"class_name\": \"OSLogEntryLog\", \"process\": \"example\"}", + "expected": { + "severity": "error" + }, + "absent": [], + "matches": [] + }, + { + "name": "Native level fault", + "dataSource": "mac-lab", + "raw": "{\"message\": \"Routine operation completed\", \"level\": \"fault\", \"class_name\": \"OSLogEntryLog\", \"process\": \"example\"}", + "expected": { + "severity": "critical" + }, + "absent": [], + "matches": [] + }, + { + "name": "Native level undefined", + "dataSource": "mac-lab", + "raw": "{\"message\": \"Routine operation completed\", \"level\": \"undefined\", \"class_name\": \"OSLogEntryLog\", \"process\": \"example\"}", + "expected": {}, + "absent": [ + "severity" + ], + "matches": [] + }, + { + "name": "Native fields take precedence over legacy aliases", + "dataSource": "mac-lab", + "raw": "{\"message\": \"Routine operation completed\", \"eventMessage\": \"ES_EVENT_TYPE authorization denied\", \"process\": \"example\", \"level\": \"notice\", \"messageType\": \"error\"}", + "expected": { + "log.message": "Routine operation completed", + "log.level": "notice", + "log.eventMessage": "ES_EVENT_TYPE authorization denied", + "log.messageType": "error" + }, + "absent": [], + "matches": [] + }, + { + "name": "Existing noise policy drop", + "dataSource": "mac-lab", + "raw": "{\"message\": \"Routine operation completed\", \"process\": \"example\", \"level\": \"notice\", \"subsystem\": \"com.apple.cloudkit\"}", + "drop": true, + "expected": {}, + "absent": [], + "matches": [] + }, + { + "name": "Wrapper 'unknown' preserves ingress", + "dataSource": "mac-lab.example", + "raw": "[utm_stack_agent_ds=unknown]-ordinary message", + "expected": { + "dataSource": "mac-lab.example", + "origin.host": "mac-lab.example", + "log.datasourceoverride": "unknown", + "log.message": "ordinary message" + }, + "absent": [ + "origin.path", + "actionResult" + ], + "matches": [] + }, + { + "name": "Wrapper '' preserves ingress", + "dataSource": "mac-lab.example", + "raw": "[utm_stack_agent_ds=]-ordinary message", + "expected": { + "dataSource": "mac-lab.example", + "origin.host": "mac-lab.example", + "log.datasourceoverride": "", + "log.message": "ordinary message" + }, + "absent": [ + "origin.path", + "actionResult" + ], + "matches": [] + }, + { + "name": "Wrapper 'bad source' preserves ingress", + "dataSource": "mac-lab.example", + "raw": "[utm_stack_agent_ds=bad source]-ordinary message", + "expected": { + "dataSource": "mac-lab.example", + "origin.host": "mac-lab.example", + "log.datasourceoverride": "bad source", + "log.message": "ordinary message" + }, + "absent": [ + "origin.path", + "actionResult" + ], + "matches": [] + }, + { + "name": "Malformed wrapper preserves ingress", + "dataSource": "mac-lab.example", + "raw": "[utm_stack_agent_ds=other.example ordinary message", + "expected": { + "dataSource": "mac-lab.example", + "origin.host": "mac-lab.example" + }, + "absent": [ + "log.message", + "log.datasourceoverride" + ], + "matches": [] + }, + { + "name": "Multiline wrapped text remains complete", + "dataSource": "mac-lab.example", + "raw": "[utm_stack_agent_ds=wrapped.example]-first line\nsecond line", + "expected": { + "dataSource": "wrapped.example", + "origin.host": "wrapped.example", + "log.message": "first line\nsecond line" + }, + "absent": [ + "log.datasourceoverride" + ], + "matches": [] + }, + { + "name": "Multiline legacy message remains complete", + "dataSource": "mac-lab.example", + "raw": "{\"eventMessage\": \"first line\\nsecond line\", \"process\": \"example\", \"messageType\": \"notice\"}", + "expected": { + "log.message": "first line\nsecond line", + "log.eventMessage": "first line\nsecond line", + "log.level": "notice", + "severity": "info", + "origin.process": "example" + }, + "absent": [ + "origin.path" + ], + "matches": [] + }, + { + "name": "Legacy notice noise applies after alias normalization", + "dataSource": "mac-lab.example", + "raw": "{\"eventMessage\": \"ordinary message\", \"messageType\": \"notice\", \"subsystem\": \"com.apple.cloudkit\"}", + "expected": {}, + "absent": [], + "matches": [], + "drop": true + }, + { + "name": "Ordinary kextload without image path is not suspicious", + "dataSource": "mac-lab.example", + "raw": "{\"process\": \"kextload\", \"message\": \"load extension\", \"class_name\": \"OSLogEntryLog\", \"level\": \"notice\", \"timestamp\": \"2026-09-17T14:00:00Z\"}", + "expected": {}, + "absent": [ + "origin.path" + ], + "matches": [] + }, + { + "name": "Executable path does not prove extension location", + "dataSource": "mac-lab.example", + "raw": "{\"process\": \"kextload\", \"processImagePath\": \"/usr/sbin/kextload\", \"message\": \"load extension\", \"class_name\": \"OSLogEntryLog\", \"level\": \"notice\", \"timestamp\": \"2026-09-17T14:00:00Z\"}", + "expected": {}, + "absent": [], + "matches": [] + }, + { + "name": "Unsigned kextload remains suspicious without image path", + "dataSource": "mac-lab.example", + "raw": "{\"process\": \"kextload\", \"message\": \"load unsigned extension\", \"class_name\": \"OSLogEntryLog\", \"level\": \"notice\", \"timestamp\": \"2026-09-17T14:00:00Z\"}", + "expected": {}, + "absent": [ + "origin.path" + ], + "matches": [ + "kernel_extension_loading" + ] + }, + { + "name": "Missing process does not prove XProtectService exclusion", + "dataSource": "mac-lab.example", + "raw": "{\"message\": \"XProtect.yara read\", \"class_name\": \"OSLogEntryLog\", \"level\": \"notice\", \"timestamp\": \"2026-09-17T14:00:00Z\"}", + "expected": {}, + "absent": [ + "origin.process" + ], + "matches": [] + }, + { + "name": "Missing process does not prove kextcache exclusion", + "dataSource": "mac-lab.example", + "raw": "{\"message\": \"/System/Library/Extensions write\", \"class_name\": \"OSLogEntryLog\", \"level\": \"notice\", \"timestamp\": \"2026-09-17T14:00:00Z\"}", + "expected": {}, + "absent": [ + "origin.process" + ], + "matches": [] + } +] diff --git a/rules/macos/admin_group_addition.yml b/rules/macos/admin_group_addition.yml index 95d1a4ff9..502438bac 100644 --- a/rules/macos/admin_group_addition.yml +++ b/rules/macos/admin_group_addition.yml @@ -24,10 +24,10 @@ description: | 5. Remove unauthorized admin group membership immediately 6. Audit all admin group members across macOS endpoints where: | - contains("log.eventMessage", "dscl") && - contains("log.eventMessage", "-append") && - contains("log.eventMessage", "/Groups/admin") && - contains("log.eventMessage", "GroupMembership") + contains("log.message", "dscl") && + contains("log.message", "-append") && + contains("log.message", "/Groups/admin") && + contains("log.message", "GroupMembership") groupBy: - adversary.host - adversary.user diff --git a/rules/macos/apple_script_abuse.yml b/rules/macos/apple_script_abuse.yml index edd3e0195..3dc80d805 100644 --- a/rules/macos/apple_script_abuse.yml +++ b/rules/macos/apple_script_abuse.yml @@ -16,7 +16,7 @@ references: - https://www.crowdstrike.com/en-us/blog/how-to-leverage-apple-unified-log-for-incident-response/ description: | Detects suspicious AppleScript execution that could indicate malicious activity, including osascript command-line usage, automation attempts, and script-based attacks on macOS systems. AppleScript can be abused by attackers to execute commands, interact with applications, and perform system manipulation. - + Next Steps: 1. Review the specific AppleScript commands being executed 2. Check if the script execution is part of legitimate automation or suspicious activity @@ -25,18 +25,18 @@ description: | 5. Look for additional indicators of compromise on the affected system 6. Consider blocking or monitoring the source if malicious intent is confirmed where: | - (oneOf("log.process", ["osascript", "Script Editor", "AppleScript", "Automator"]) || - contains("log.eventMessage", "osascript") || - contains("log.eventMessage", "AppleScript") || + (oneOf("origin.process", ["osascript", "Script Editor", "AppleScript", "Automator"]) || + contains("log.message", "osascript") || + contains("log.message", "AppleScript") || equals("log.subsystem", "com.apple.applescript")) && - (contains("log.eventMessage", "tell application") || - contains("log.eventMessage", "do shell script") || - contains("log.eventMessage", "keystroke") || - contains("log.eventMessage", "System Events") || - contains("log.eventMessage", "admin privileges") || - contains("log.eventMessage", "sudo") || - contains("log.eventMessage", "password")) && - oneOf("log.eventType", ["logEvent", "traceEvent"]) + (contains("log.message", "tell application") || + contains("log.message", "do shell script") || + contains("log.message", "keystroke") || + contains("log.message", "System Events") || + contains("log.message", "admin privileges") || + contains("log.message", "sudo") || + contains("log.message", "password")) && + (oneOf("log.eventType", ["logEvent", "traceEvent"]) || equals("log.className", "OSLogEntryLog")) groupBy: - adversary.host - adversary.user diff --git a/rules/macos/browser_child_process_exploitation.yml b/rules/macos/browser_child_process_exploitation.yml index e5ba60d8d..12ac8b9af 100644 --- a/rules/macos/browser_child_process_exploitation.yml +++ b/rules/macos/browser_child_process_exploitation.yml @@ -25,13 +25,13 @@ description: | 5. Scan the system for malware and check for additional exploitation indicators 6. Review browser extensions for malicious or compromised add-ons where: | - contains("log.eventMessage", ["/Applications/Safari.app", "/Applications/Google Chrome.app", "/Applications/Firefox.app", "com.apple.Safari", "com.google.Chrome", "org.mozilla.firefox"]) && - contains("log.eventMessage", ["bash", "sh ", "curl ", "wget ", "python", "osascript", "perl ", "ruby "]) && + contains("log.message", ["/Applications/Safari.app", "/Applications/Google Chrome.app", "/Applications/Firefox.app", "com.apple.Safari", "com.google.Chrome", "org.mozilla.firefox"]) && + contains("log.message", ["bash", "sh ", "curl ", "wget ", "python", "osascript", "perl ", "ruby "]) && ( - contains("log.eventMessage", "spawn") || - contains("log.eventMessage", "exec") || - contains("log.eventMessage", "fork") || - contains("log.eventMessage", "child process") + contains("log.message", "spawn") || + contains("log.message", "exec") || + contains("log.message", "fork") || + contains("log.message", "child process") ) groupBy: - adversary.host diff --git a/rules/macos/cron_job_persistence.yml b/rules/macos/cron_job_persistence.yml index edafb498e..112eaee22 100644 --- a/rules/macos/cron_job_persistence.yml +++ b/rules/macos/cron_job_persistence.yml @@ -22,10 +22,10 @@ description: | 4. Remove unauthorized cron entries 5. Check for other persistence mechanisms where: | - (contains("log.eventMessage", "crontab") || equals("log.process", "cron")) && - (contains("log.eventMessage", "REPLACE") || contains("log.eventMessage", "INSTALL") || - contains("log.eventMessage", "BEGIN EDIT") || contains("log.eventMessage", "END EDIT") || - contains("log.eventMessage", "crontab") && contains("log.eventMessage", "modified")) + (contains("log.message", "crontab") || equals("origin.process", "cron")) && + (contains("log.message", "REPLACE") || contains("log.message", "INSTALL") || + contains("log.message", "BEGIN EDIT") || contains("log.message", "END EDIT") || + contains("log.message", "crontab") && contains("log.message", "modified")) groupBy: - adversary.host - adversary.user diff --git a/rules/macos/dylib_hijacking.yml b/rules/macos/dylib_hijacking.yml index 6e0ec0f5f..f64980921 100644 --- a/rules/macos/dylib_hijacking.yml +++ b/rules/macos/dylib_hijacking.yml @@ -24,11 +24,11 @@ description: | 5. Check for weak dylib references using otool 6. Remove the malicious dylib and investigate the delivery method where: | - (contains("log.eventMessage", "dylib") || contains("log.eventMessage", "DYLD")) && - (contains("log.eventMessage", "hijack") || contains("log.eventMessage", "suspicious") || - contains("log.eventMessage", "unsigned") || contains("log.eventMessage", "load failed") || - (contains("log.eventMessage", "DYLD_INSERT_LIBRARIES") && contains("log.eventMessage", "set")) || - regexMatch("log.eventMessage", "(?i)dylib.*(/tmp/|/Users/.*/Downloads/|/var/tmp/)")) + (contains("log.message", "dylib") || contains("log.message", "DYLD")) && + (contains("log.message", "hijack") || contains("log.message", "suspicious") || + contains("log.message", "unsigned") || contains("log.message", "load failed") || + (contains("log.message", "DYLD_INSERT_LIBRARIES") && contains("log.message", "set")) || + regexMatch("log.message", "(?i)dylib.*(/tmp/|/Users/.*/Downloads/|/var/tmp/)")) groupBy: - - lastEvent.log.eventMessage + - lastEvent.log.message - adversary.host diff --git a/rules/macos/endpoint_security_bypass.yml b/rules/macos/endpoint_security_bypass.yml index 29203fcfd..6007ab226 100644 --- a/rules/macos/endpoint_security_bypass.yml +++ b/rules/macos/endpoint_security_bypass.yml @@ -15,7 +15,7 @@ references: - https://developer.apple.com/documentation/endpointsecurity description: | Detects attempts to bypass or tamper with the macOS Endpoint Security framework, which could indicate malicious activity trying to evade security monitoring. The Endpoint Security framework is a critical component for system security monitoring and its compromise can allow attackers to operate undetected. - + Next Steps: 1. Investigate the affected system and identify the process attempting to bypass endpoint security 2. Check for suspicious process executions or file modifications around the time of the alert @@ -24,8 +24,9 @@ description: | 5. Consider isolating the affected system if malicious activity is confirmed 6. Check for persistence mechanisms that might be attempting to disable security controls where: | + !oneOf("dataSource", ["", "unknown"]) && (equals("log.subsystem", "com.apple.endpointsecurity") || - contains("log.process", "EndpointSecurity") || + contains("origin.process", "EndpointSecurity") || contains("log.message", "ES_EVENT_TYPE")) && (contains("log.message", "bypass") || contains("log.message", "failed authorization") || @@ -33,16 +34,19 @@ where: | contains("log.message", "authorization denied") || contains("log.message", "invalid client") || contains("log.message", "ES_RETURN_ERROR") || - equals("log.eventType", "error") || + equals("log.level", "error") || contains("log.message", "memory leak detected")) afterEvents: - indexPattern: v11-log-macos-* with: - - field: system.hostname + - field: dataSource + operator: filter_term + value: '{{.dataSource}}' + - field: log.correlationCandidate.endpointSecurity operator: filter_term - value: '{{.system.hostname}}' + value: match within: 15m count: 2 groupBy: - - lastEvent.log.process - - lastEvent.system.hostname + - adversary.process + - lastEvent.dataSource diff --git a/rules/macos/folder_action_scripts.yml b/rules/macos/folder_action_scripts.yml index 7c8f197de..a3dbc4556 100644 --- a/rules/macos/folder_action_scripts.yml +++ b/rules/macos/folder_action_scripts.yml @@ -24,11 +24,11 @@ description: | 5. Remove unauthorized Folder Action scripts 6. Check com.apple.FolderActions.plist for modifications where: | - (contains("log.eventMessage", "Folder Action") || contains("log.eventMessage", "FolderActions") || - contains("log.eventMessage", "com.apple.FolderActions")) && - (contains("log.eventMessage", "attached") || contains("log.eventMessage", "enabled") || - contains("log.eventMessage", "added") || contains("log.eventMessage", "script") || - contains("log.eventMessage", "modified")) + (contains("log.message", "Folder Action") || contains("log.message", "FolderActions") || + contains("log.message", "com.apple.FolderActions")) && + (contains("log.message", "attached") || contains("log.message", "enabled") || + contains("log.message", "added") || contains("log.message", "script") || + contains("log.message", "modified")) groupBy: - adversary.host - adversary.user diff --git a/rules/macos/gatekeeper_bypass_attempts.yml b/rules/macos/gatekeeper_bypass_attempts.yml index 610fde0ec..55a14d81b 100644 --- a/rules/macos/gatekeeper_bypass_attempts.yml +++ b/rules/macos/gatekeeper_bypass_attempts.yml @@ -30,28 +30,28 @@ description: | 10. Document the incident and update security policies as needed where: | ( - equals("log.process", "syspolicyd") && + equals("origin.process", "syspolicyd") && ( - regexMatch("log.eventMessage", ".*assessment.*bypass.*") || - regexMatch("log.eventMessage", ".*quarantine.*removed.*") || - regexMatch("log.eventMessage", ".*GKE.*override.*") + regexMatch("log.message", ".*assessment.*bypass.*") || + regexMatch("log.message", ".*quarantine.*removed.*") || + regexMatch("log.message", ".*GKE.*override.*") ) ) || ( - regexMatch("log.eventMessage", ".*xattr.*-d.*com\\.apple\\.quarantine.*") && - equals("log.eventType", "logEvent") + regexMatch("log.message", ".*xattr.*-d.*com\\.apple\\.quarantine.*") && + (equals("log.eventType", "logEvent") || equals("log.className", "OSLogEntryLog")) ) || ( - regexMatch("log.processImagePath", ".*/var/db/SystemPolicy.*") && - regexMatch("log.eventMessage", ".*(modify|write|delete).*") + regexMatch("origin.path", ".*/var/db/SystemPolicy.*") && + regexMatch("log.message", ".*(modify|write|delete).*") ) || ( equals("log.subsystem", "com.apple.security.assessment") && - (contains("log.eventMessage", "bypass") || contains("log.eventMessage", "override") || contains("log.eventMessage", "disable")) + (contains("log.message", "bypass") || contains("log.message", "override") || contains("log.message", "disable")) ) || ( - equals("log.process", "spctl") && - contains("log.eventMessage", "--disable") + equals("origin.process", "spctl") && + contains("log.message", "--disable") ) groupBy: - adversary.host diff --git a/rules/macos/gatekeeper_xattr_bypass.yml b/rules/macos/gatekeeper_xattr_bypass.yml index 786b67c92..066aa8083 100644 --- a/rules/macos/gatekeeper_xattr_bypass.yml +++ b/rules/macos/gatekeeper_xattr_bypass.yml @@ -24,9 +24,9 @@ description: | 5. Scan the file with antimalware tools 6. Review download history to determine the origin of the file where: | - contains("log.eventMessage", "xattr") && - contains("log.eventMessage", "-d") && - contains("log.eventMessage", "com.apple.quarantine") + contains("log.message", "xattr") && + contains("log.message", "-d") && + contains("log.message", "com.apple.quarantine") groupBy: - adversary.host - adversary.user diff --git a/rules/macos/gui_input_capture.yml b/rules/macos/gui_input_capture.yml index a9825b100..5fb05de31 100644 --- a/rules/macos/gui_input_capture.yml +++ b/rules/macos/gui_input_capture.yml @@ -24,9 +24,9 @@ description: | 5. Reset the affected user's password immediately as a precaution 6. Search for related osascript executions across the environment where: | - (equals("log.process", "osascript") || contains("log.eventMessage", "osascript")) && - contains("log.eventMessage", "display dialog") && - (contains("log.eventMessage", "hidden answer") || contains("log.eventMessage", "password")) + (equals("origin.process", "osascript") || contains("log.message", "osascript")) && + contains("log.message", "display dialog") && + (contains("log.message", "hidden answer") || contains("log.message", "password")) groupBy: - adversary.host - adversary.user diff --git a/rules/macos/hidden_user_creation.yml b/rules/macos/hidden_user_creation.yml index 7b88bda71..52e64725b 100644 --- a/rules/macos/hidden_user_creation.yml +++ b/rules/macos/hidden_user_creation.yml @@ -23,13 +23,13 @@ description: | 5. Disable and remove the unauthorized account 6. Review system access logs for the hidden account where: | - (contains("log.eventMessage", "dscl") || contains("log.eventMessage", "sysadminctl") || - contains("log.eventMessage", "dseditgroup")) && - (contains("log.eventMessage", "IsHidden") || - (contains("log.eventMessage", "create") && contains("log.eventMessage", "/Users/")) || - (contains("log.eventMessage", "UniqueID") && contains("log.eventMessage", "create")) || - contains("log.eventMessage", "hidden user") || - regexMatch("log.eventMessage", "(?i)dscl.*create.*/Users/.*IsHidden.*1")) + (contains("log.message", "dscl") || contains("log.message", "sysadminctl") || + contains("log.message", "dseditgroup")) && + (contains("log.message", "IsHidden") || + (contains("log.message", "create") && contains("log.message", "/Users/")) || + (contains("log.message", "UniqueID") && contains("log.message", "create")) || + contains("log.message", "hidden user") || + regexMatch("log.message", "(?i)dscl.*create.*/Users/.*IsHidden.*1")) groupBy: - adversary.host - adversary.user diff --git a/rules/macos/jxa_in_memory_execution.yml b/rules/macos/jxa_in_memory_execution.yml index c0a78a52c..a9c6dff96 100644 --- a/rules/macos/jxa_in_memory_execution.yml +++ b/rules/macos/jxa_in_memory_execution.yml @@ -25,13 +25,13 @@ description: | 5. Examine the system for any persistence mechanisms installed by the payload 6. Block the identified payload URL at the network level where: | - (equals("log.process", "osascript") || contains("log.eventMessage", "osascript")) && - contains("log.eventMessage", ["-e", "-l JavaScript"]) && + (equals("origin.process", "osascript") || contains("log.message", "osascript")) && + contains("log.message", ["-e", "-l JavaScript"]) && ( - contains("log.eventMessage", "eval") || - contains("log.eventMessage", "NSData.dataWithContentsOfURL") || - contains("log.eventMessage", "ObjC.import") || - (contains("log.eventMessage", "JavaScript") && contains("log.eventMessage", "dataWithContentsOfURL")) + contains("log.message", "eval") || + contains("log.message", "NSData.dataWithContentsOfURL") || + contains("log.message", "ObjC.import") || + (contains("log.message", "JavaScript") && contains("log.message", "dataWithContentsOfURL")) ) groupBy: - adversary.host diff --git a/rules/macos/kernel_extension_loading.yml b/rules/macos/kernel_extension_loading.yml index db8cc5ffd..9eeaf98ce 100644 --- a/rules/macos/kernel_extension_loading.yml +++ b/rules/macos/kernel_extension_loading.yml @@ -15,7 +15,7 @@ references: - https://attack.mitre.org/techniques/T1547/006/ description: | Detects suspicious or unauthorized kernel extension (kext) loading attempts that could indicate rootkit installation or system compromise. This rule monitors for kext loading activities that bypass normal security protections, involve unsigned or invalid extensions, or occur in sensitive system directories. - + Next Steps: 1. Investigate the specific kernel extension being loaded and verify its legitimacy 2. Check if the extension is signed by a trusted developer @@ -26,43 +26,42 @@ description: | 7. Review system integrity and scan for additional persistence mechanisms where: | ( - regexMatch("log.process", ".*(kextload|kextutil|kextcache).*") && + regexMatch("origin.process", ".*(kextload|kextutil|kextcache).*") && ( - contains("log.eventMessage", "load") || - contains("log.eventMessage", "install") + contains("log.message", "load") || + contains("log.message", "install") ) && ( - !regexMatch("log.processImagePath", ".*/System/Library/.*") || - contains("log.eventMessage", "unsigned") || - regexMatch("log.eventMessage", ".*invalid.*signature.*") + contains("log.message", "unsigned") || + regexMatch("log.message", ".*invalid.*signature.*") ) ) || ( equals("log.subsystem", "com.apple.kernel") && - contains("log.eventMessage", "kext") && + contains("log.message", "kext") && ( - regexMatch("log.eventMessage", ".*load.*failed.*") || - regexMatch("log.eventMessage", ".*authentication.*error.*") || - contains("log.eventMessage", "rootless") + regexMatch("log.message", ".*load.*failed.*") || + regexMatch("log.message", ".*authentication.*error.*") || + contains("log.message", "rootless") ) ) || ( - equals("log.process", "kernel") && - contains("log.eventMessage", "kext") && + equals("origin.process", "kernel") && + contains("log.message", "kext") && ( - regexMatch("log.eventMessage", ".*third.*party.*") || - contains("log.eventMessage", "unsigned") || - regexMatch("log.eventMessage", ".*developer.*mode.*") + regexMatch("log.message", ".*third.*party.*") || + contains("log.message", "unsigned") || + regexMatch("log.message", ".*developer.*mode.*") ) ) || ( - contains("log.eventMessage", "/System/Library/Extensions") && - regexMatch("log.eventMessage", ".*(modify|write|create).*") && - !equals("log.process", "kextcache") + contains("log.message", "/System/Library/Extensions") && + regexMatch("log.message", ".*(modify|write|create).*") && + exists("origin.process") && !equals("origin.process", "kextcache") ) || ( - equals("log.process", "eslogger") && - regexMatch("log.eventMessage", ".*kext.*bypass.*") + equals("origin.process", "eslogger") && + regexMatch("log.message", ".*kext.*bypass.*") ) groupBy: - adversary.host diff --git a/rules/macos/keychain_access_violations.yml b/rules/macos/keychain_access_violations.yml index f094f51d1..93d32839b 100644 --- a/rules/macos/keychain_access_violations.yml +++ b/rules/macos/keychain_access_violations.yml @@ -16,7 +16,7 @@ references: - https://jumpcloud.com/support/understand-mac-keychain-access description: | Detects unauthorized or suspicious attempts to access macOS Keychain, including failed access attempts, unusual process access, and potential credential theft activities. This rule identifies security subsystem events related to keychain access failures, denials, or unauthorized attempts. - + Next Steps: 1. Investigate the process attempting keychain access and verify if it's legitimate 2. Check for any recent malware infections or suspicious processes on the affected host @@ -25,19 +25,19 @@ description: | 5. Consider resetting credentials if unauthorized access is confirmed 6. Monitor for additional credential access attempts from the same host or user where: | - (equals("log.subsystem", "com.apple.security") || + (equals("log.subsystem", "com.apple.security") || equals("log.subsystem", "com.apple.securityd") || - equals("log.process", "securityd") || - equals("log.process", "security")) && - (contains("log.eventMessage", "keychain") || - contains("log.eventMessage", "Keychain")) && - (contains("log.eventMessage", "error") || - contains("log.eventMessage", "failed") || - contains("log.eventMessage", "denied") || - contains("log.eventMessage", "unauthorized") || - contains("log.eventMessage", "-25308") || - contains("log.eventMessage", "accountsd wants to use")) && - oneOf("log.messageType", ["error", "fault"]) + equals("origin.process", "securityd") || + equals("origin.process", "security")) && + (contains("log.message", "keychain") || + contains("log.message", "Keychain")) && + (contains("log.message", "error") || + contains("log.message", "failed") || + contains("log.message", "denied") || + contains("log.message", "unauthorized") || + contains("log.message", "-25308") || + contains("log.message", "accountsd wants to use")) && + oneOf("log.level", ["error", "fault"]) groupBy: - adversary.host - adversary.user diff --git a/rules/macos/keychain_credential_dumping.yml b/rules/macos/keychain_credential_dumping.yml index 1be2a6ac0..8409dfa12 100644 --- a/rules/macos/keychain_credential_dumping.yml +++ b/rules/macos/keychain_credential_dumping.yml @@ -24,13 +24,13 @@ description: | 5. Review the process tree for the parent process and execution context 6. Check for lateral movement using any harvested credentials where: | - (equals("log.process", "security") || contains("log.eventMessage", "/usr/bin/security")) && + (equals("origin.process", "security") || contains("log.message", "/usr/bin/security")) && ( - contains("log.eventMessage", "find-certificate") || - contains("log.eventMessage", "dump-keychain") || - contains("log.eventMessage", "export -t") || - contains("log.eventMessage", "find-generic-password") || - contains("log.eventMessage", "find-internet-password") + contains("log.message", "find-certificate") || + contains("log.message", "dump-keychain") || + contains("log.message", "export -t") || + contains("log.message", "find-generic-password") || + contains("log.message", "find-internet-password") ) groupBy: - adversary.host diff --git a/rules/macos/keychain_dumping_cli.yml b/rules/macos/keychain_dumping_cli.yml index ed7a32e62..036783d4c 100644 --- a/rules/macos/keychain_dumping_cli.yml +++ b/rules/macos/keychain_dumping_cli.yml @@ -23,12 +23,12 @@ description: | 5. Review the attack chain leading to keychain access 6. Consider restricting keychain access via MDM policies where: | - (equals("log.process", "security") || contains("log.eventMessage", "security ")) && - (contains("log.eventMessage", "dump-keychain") || - contains("log.eventMessage", "find-generic-password") && contains("log.eventMessage", "-w") || - contains("log.eventMessage", "find-internet-password") && contains("log.eventMessage", "-w") || - contains("log.eventMessage", "export-keychain") || - contains("log.eventMessage", "unlock-keychain") && contains("log.eventMessage", "-p")) + (equals("origin.process", "security") || contains("log.message", "security ")) && + (contains("log.message", "dump-keychain") || + contains("log.message", "find-generic-password") && contains("log.message", "-w") || + contains("log.message", "find-internet-password") && contains("log.message", "-w") || + contains("log.message", "export-keychain") || + contains("log.message", "unlock-keychain") && contains("log.message", "-p")) groupBy: - adversary.host - adversary.user diff --git a/rules/macos/launch_agent_daemon_persistence.yml b/rules/macos/launch_agent_daemon_persistence.yml index b7536e607..2d0a542a4 100644 --- a/rules/macos/launch_agent_daemon_persistence.yml +++ b/rules/macos/launch_agent_daemon_persistence.yml @@ -16,7 +16,7 @@ references: - https://www.crowdstrike.com/en-us/blog/how-to-leverage-apple-unified-log-for-incident-response/ description: | Detects suspicious creation or modification of Launch Agents and Launch Daemons which are commonly used for persistence on macOS systems. Monitors for new plist files being created in LaunchAgents or LaunchDaemons directories. - + Next Steps: 1. Review the specific Launch Agent/Daemon plist file that was created or modified 2. Examine the contents of the plist file for suspicious commands or executables @@ -26,14 +26,14 @@ description: | 6. Check for other persistence mechanisms on the affected system 7. Consider isolating the system if malicious persistence is confirmed where: | - (equals("log.subsystem", "com.apple.launchd") || equals("log.process", "launchd")) && - (contains("log.eventMessage", "LaunchAgent") || contains("log.eventMessage", "LaunchDaemon")) && - (contains("log.eventMessage", "loaded") || contains("log.eventMessage", "started") || contains("log.eventMessage", "created")) && - (contains("log.eventMessage", "/Library/LaunchAgents") || - contains("log.eventMessage", "/Library/LaunchDaemons") || - contains("log.eventMessage", "/System/Library/LaunchAgents") || - contains("log.eventMessage", "/System/Library/LaunchDaemons") || - contains("log.eventMessage", "~/Library/LaunchAgents")) + (equals("log.subsystem", "com.apple.launchd") || equals("origin.process", "launchd")) && + (contains("log.message", "LaunchAgent") || contains("log.message", "LaunchDaemon")) && + (contains("log.message", "loaded") || contains("log.message", "started") || contains("log.message", "created")) && + (contains("log.message", "/Library/LaunchAgents") || + contains("log.message", "/Library/LaunchDaemons") || + contains("log.message", "/System/Library/LaunchAgents") || + contains("log.message", "/System/Library/LaunchDaemons") || + contains("log.message", "~/Library/LaunchAgents")) groupBy: - - lastEvent.log.eventMessage + - lastEvent.log.message - adversary.host diff --git a/rules/macos/login_items_persistence.yml b/rules/macos/login_items_persistence.yml index ce4568207..137165147 100644 --- a/rules/macos/login_items_persistence.yml +++ b/rules/macos/login_items_persistence.yml @@ -24,11 +24,11 @@ description: | 5. Check ~/Library/Application Support/com.apple.backgroundtaskmanagementagent/ 6. Remove unauthorized Login Items and investigate the source where: | - (contains("log.eventMessage", "Login Item") || contains("log.eventMessage", "loginitem") || - contains("log.eventMessage", "BackgroundItems") || contains("log.eventMessage", "loginwindow")) && - (contains("log.eventMessage", "added") || contains("log.eventMessage", "registered") || - contains("log.eventMessage", "enabled") || contains("log.eventMessage", "modified") || - contains("log.eventMessage", "SMLoginItemSetEnabled")) + (contains("log.message", "Login Item") || contains("log.message", "loginitem") || + contains("log.message", "BackgroundItems") || contains("log.message", "loginwindow")) && + (contains("log.message", "added") || contains("log.message", "registered") || + contains("log.message", "enabled") || contains("log.message", "modified") || + contains("log.message", "SMLoginItemSetEnabled")) groupBy: - - lastEvent.log.eventMessage + - lastEvent.log.message - adversary.host diff --git a/rules/macos/macos_ransomware_indicators.yml b/rules/macos/macos_ransomware_indicators.yml index 9097ed7e8..401d2c432 100644 --- a/rules/macos/macos_ransomware_indicators.yml +++ b/rules/macos/macos_ransomware_indicators.yml @@ -23,16 +23,20 @@ description: | 5. Preserve evidence for forensic analysis 6. Do not pay ransom - engage incident response team where: | - (contains("log.eventMessage", ["encrypted", "encrypt", ".locked", ".crypto", ".crypt"]) || - regexMatch("log.eventMessage", "(?i)\\.(locky|cerber|wannacry|ryuk|maze|conti|lockbit)$")) && - (contains("log.eventMessage", "rename") || contains("log.eventMessage", "modified") || - contains("log.eventMessage", "write")) + !oneOf("dataSource", ["", "unknown"]) && + ( (contains("log.message", ["encrypted", "encrypt", ".locked", ".crypto", ".crypt"]) || + regexMatch("log.message", "(?i)\\.(locky|cerber|wannacry|ryuk|maze|conti|lockbit)$")) && + (contains("log.message", "rename") || contains("log.message", "modified") || + contains("log.message", "write"))) afterEvents: - indexPattern: v11-log-macos-* with: - - field: origin.host + - field: dataSource operator: filter_term - value: '{{.origin.host}}' + value: '{{.dataSource}}' + - field: log.correlationCandidate.ransomware + operator: filter_term + value: match within: 10m count: 50 groupBy: diff --git a/rules/macos/notarization_bypass_attempts.yml b/rules/macos/notarization_bypass_attempts.yml index 0abc3a495..c40f61dd4 100644 --- a/rules/macos/notarization_bypass_attempts.yml +++ b/rules/macos/notarization_bypass_attempts.yml @@ -26,12 +26,12 @@ description: | 7. Consider quarantining the affected system if malicious activity is confirmed 8. Review security policies regarding software installation and execution where: | - (equals("log.process", "spctl") && contains("log.eventMessage", "assessment")) || - (equals("log.subsystem", "com.apple.xprotect") && contains("log.eventMessage", "failed on rPathCmd")) || - (contains("log.eventMessage", "com.apple.quarantine") && contains("log.eventMessage", "remove")) || - (equals("log.process", "xattr") && contains("log.eventMessage", "-d com.apple.quarantine")) || - (contains("log.eventMessage", "LSFileQuarantineEnabled") && contains("log.eventMessage", "false")) || - (contains("log.eventMessage", "ACL") && contains("log.eventMessage", "quarantine")) + (equals("origin.process", "spctl") && contains("log.message", "assessment")) || + (equals("log.subsystem", "com.apple.xprotect") && contains("log.message", "failed on rPathCmd")) || + (contains("log.message", "com.apple.quarantine") && contains("log.message", "remove")) || + (equals("origin.process", "xattr") && contains("log.message", "-d com.apple.quarantine")) || + (contains("log.message", "LSFileQuarantineEnabled") && contains("log.message", "false")) || + (contains("log.message", "ACL") && contains("log.message", "quarantine")) groupBy: - adversary.host - adversary.user diff --git a/rules/macos/office_macro_exploitation.yml b/rules/macos/office_macro_exploitation.yml index 1dbe97d75..3cbbdd3c4 100644 --- a/rules/macos/office_macro_exploitation.yml +++ b/rules/macos/office_macro_exploitation.yml @@ -24,13 +24,13 @@ description: | 5. Review email logs to identify how the document was delivered 6. Alert other users who may have received the same document where: | - contains("log.eventMessage", ["Microsoft Word", "Microsoft Excel", "Microsoft PowerPoint", "com.microsoft.Word", "com.microsoft.Excel", "com.microsoft.PowerPoint"]) && - contains("log.eventMessage", ["bash", "sh ", "curl ", "wget ", "python", "osascript", "perl "]) && + contains("log.message", ["Microsoft Word", "Microsoft Excel", "Microsoft PowerPoint", "com.microsoft.Word", "com.microsoft.Excel", "com.microsoft.PowerPoint"]) && + contains("log.message", ["bash", "sh ", "curl ", "wget ", "python", "osascript", "perl "]) && ( - contains("log.eventMessage", "spawn") || - contains("log.eventMessage", "exec") || - contains("log.eventMessage", "fork") || - contains("log.eventMessage", "child process") + contains("log.message", "spawn") || + contains("log.message", "exec") || + contains("log.message", "fork") || + contains("log.message", "child process") ) groupBy: - adversary.host diff --git a/rules/macos/osascript_encoded_execution.yml b/rules/macos/osascript_encoded_execution.yml index a52a030d1..bf084d8da 100644 --- a/rules/macos/osascript_encoded_execution.yml +++ b/rules/macos/osascript_encoded_execution.yml @@ -22,15 +22,15 @@ description: | 4. Review network connections initiated by the script 5. Investigate the delivery mechanism of the malicious script where: | - (equals("log.process", "osascript") || contains("log.eventMessage", "osascript")) && - (contains("log.eventMessage", "-e") && - (contains("log.eventMessage", "do shell script") || contains("log.eventMessage", "curl") || - contains("log.eventMessage", "wget") || contains("log.eventMessage", "base64") || - contains("log.eventMessage", "chmod") || contains("log.eventMessage", "/bin/bash") || - contains("log.eventMessage", "python") || contains("log.eventMessage", "openssl")) || - contains("log.eventMessage", "osacompile") || - (contains("log.eventMessage", "osascript") && contains("log.eventMessage", "<<<")) || - regexMatch("log.eventMessage", "(?i)osascript.*-l\\s+JavaScript")) + (equals("origin.process", "osascript") || contains("log.message", "osascript")) && + (contains("log.message", "-e") && + (contains("log.message", "do shell script") || contains("log.message", "curl") || + contains("log.message", "wget") || contains("log.message", "base64") || + contains("log.message", "chmod") || contains("log.message", "/bin/bash") || + contains("log.message", "python") || contains("log.message", "openssl")) || + contains("log.message", "osacompile") || + (contains("log.message", "osascript") && contains("log.message", "<<<")) || + regexMatch("log.message", "(?i)osascript.*-l\\s+JavaScript")) groupBy: - adversary.host - adversary.user diff --git a/rules/macos/plistbuddy_persistence.yml b/rules/macos/plistbuddy_persistence.yml index 82c6692bb..bd421da91 100644 --- a/rules/macos/plistbuddy_persistence.yml +++ b/rules/macos/plistbuddy_persistence.yml @@ -24,9 +24,9 @@ description: | 5. Remove the malicious plist file and associated executables 6. Check for other LaunchAgent/LaunchDaemon persistence on the system where: | - contains("log.eventMessage", "PlistBuddy") && - contains("log.eventMessage", "RunAtLoad") && - contains("log.eventMessage", ["LaunchAgents", "LaunchDaemons"]) + contains("log.message", "PlistBuddy") && + contains("log.message", "RunAtLoad") && + contains("log.message", ["LaunchAgents", "LaunchDaemons"]) groupBy: - adversary.host - adversary.user diff --git a/rules/macos/privacy_preferences_tampering.yml b/rules/macos/privacy_preferences_tampering.yml index 07f0ee727..7d38bb6ef 100644 --- a/rules/macos/privacy_preferences_tampering.yml +++ b/rules/macos/privacy_preferences_tampering.yml @@ -24,13 +24,13 @@ description: | 5. Verify the integrity of system privacy settings and restore from backup if necessary 6. Consider implementing additional monitoring for TCC database access where: | - (contains("log.eventMessage", "Update Access Record:") && equals("log.subsystem", "com.apple.TCC")) || - (equals("log.process", "sqlite3") && contains("log.eventMessage", "TCC.db")) || - (equals("log.process", "tccutil") && contains("log.eventMessage", "reset")) || - (contains("log.eventMessage", "TCC") && contains("log.eventMessage", "INSERT")) || - (contains("log.eventMessage", "TCC") && contains("log.eventMessage", "UPDATE")) || - (contains("log.eventMessage", "TCC") && contains("log.eventMessage", "DELETE")) || - (equals("log.subsystem", "com.apple.TCC") && equals("log.category", "access") && contains("log.eventMessage", "modification")) + (contains("log.message", "Update Access Record:") && equals("log.subsystem", "com.apple.TCC")) || + (equals("origin.process", "sqlite3") && contains("log.message", "TCC.db")) || + (equals("origin.process", "tccutil") && contains("log.message", "reset")) || + (contains("log.message", "TCC") && contains("log.message", "INSERT")) || + (contains("log.message", "TCC") && contains("log.message", "UPDATE")) || + (contains("log.message", "TCC") && contains("log.message", "DELETE")) || + (equals("log.subsystem", "com.apple.TCC") && equals("log.category", "access") && contains("log.message", "modification")) groupBy: - adversary.host - adversary.user diff --git a/rules/macos/root_account_enable.yml b/rules/macos/root_account_enable.yml index 0d1608404..b47d0cae8 100644 --- a/rules/macos/root_account_enable.yml +++ b/rules/macos/root_account_enable.yml @@ -25,8 +25,8 @@ description: | 5. Review the system for other privilege escalation or persistence mechanisms 6. Audit sudo and su usage on the affected system where: | - contains("log.eventMessage", "dsenableroot") && - !contains("log.eventMessage", "-d") + contains("log.message", "dsenableroot") && + !contains("log.message", "-d") groupBy: - adversary.host - adversary.user diff --git a/rules/macos/security_tools_disabling.yml b/rules/macos/security_tools_disabling.yml index bd85a325d..71a546041 100644 --- a/rules/macos/security_tools_disabling.yml +++ b/rules/macos/security_tools_disabling.yml @@ -25,24 +25,24 @@ description: | 6. Investigate why the user had privileges to disable security tools where: | ( - contains("log.eventMessage", "launchctl") && - contains("log.eventMessage", "unload") && + contains("log.message", "launchctl") && + contains("log.message", "unload") && ( - contains("log.eventMessage", "LuLu") || - contains("log.eventMessage", "BlockBlock") || - contains("log.eventMessage", "Santa") || - contains("log.eventMessage", "CarbonBlack") || - contains("log.eventMessage", "com.carbonblack") || - contains("log.eventMessage", "CrowdStrike") || - contains("log.eventMessage", "com.crowdstrike") || - contains("log.eventMessage", "osquery") || - contains("log.eventMessage", "com.facebook.osqueryd") || - contains("log.eventMessage", "com.objective-see") + contains("log.message", "LuLu") || + contains("log.message", "BlockBlock") || + contains("log.message", "Santa") || + contains("log.message", "CarbonBlack") || + contains("log.message", "com.carbonblack") || + contains("log.message", "CrowdStrike") || + contains("log.message", "com.crowdstrike") || + contains("log.message", "osquery") || + contains("log.message", "com.facebook.osqueryd") || + contains("log.message", "com.objective-see") ) ) || ( - contains("log.eventMessage", "spctl") && - contains("log.eventMessage", "--master-disable") + contains("log.message", "spctl") && + contains("log.message", "--master-disable") ) groupBy: - adversary.host diff --git a/rules/macos/shell_profile_modification.yml b/rules/macos/shell_profile_modification.yml index c7d925c84..d559221a2 100644 --- a/rules/macos/shell_profile_modification.yml +++ b/rules/macos/shell_profile_modification.yml @@ -22,12 +22,12 @@ description: | 4. Identify the user and process that made the change 5. Restore the profile from backup if tampered where: | - (contains("log.eventMessage", ".bash_profile") || contains("log.eventMessage", ".zshrc") || - contains("log.eventMessage", ".zprofile") || contains("log.eventMessage", ".bashrc") || - contains("log.eventMessage", ".zshenv") || contains("log.eventMessage", "/etc/zshrc") || - contains("log.eventMessage", "/etc/profile")) && - (contains("log.eventMessage", "modified") || contains("log.eventMessage", "written") || - contains("log.eventMessage", "created") || contains("log.eventMessage", "changed")) + (contains("log.message", ".bash_profile") || contains("log.message", ".zshrc") || + contains("log.message", ".zprofile") || contains("log.message", ".bashrc") || + contains("log.message", ".zshenv") || contains("log.message", "/etc/zshrc") || + contains("log.message", "/etc/profile")) && + (contains("log.message", "modified") || contains("log.message", "written") || + contains("log.message", "created") || contains("log.message", "changed")) groupBy: - adversary.host - adversary.user diff --git a/rules/macos/ssh_key_theft.yml b/rules/macos/ssh_key_theft.yml index 1a189026c..bf432e0aa 100644 --- a/rules/macos/ssh_key_theft.yml +++ b/rules/macos/ssh_key_theft.yml @@ -23,12 +23,12 @@ description: | 5. Check for lateral movement using the stolen key 6. Investigate the initial compromise vector where: | - (contains("log.eventMessage", ".ssh/id_rsa") || contains("log.eventMessage", ".ssh/id_ed25519") || - contains("log.eventMessage", ".ssh/id_ecdsa") || contains("log.eventMessage", ".ssh/id_dsa") || - contains("log.eventMessage", ".ssh/identity")) && - (contains("log.eventMessage", "read") || contains("log.eventMessage", "copy") || - contains("log.eventMessage", "open") || contains("log.eventMessage", "cat") || - contains("log.eventMessage", "scp") || contains("log.eventMessage", "base64")) + (contains("log.message", ".ssh/id_rsa") || contains("log.message", ".ssh/id_ed25519") || + contains("log.message", ".ssh/id_ecdsa") || contains("log.message", ".ssh/id_dsa") || + contains("log.message", ".ssh/identity")) && + (contains("log.message", "read") || contains("log.message", "copy") || + contains("log.message", "open") || contains("log.message", "cat") || + contains("log.message", "scp") || contains("log.message", "base64")) groupBy: - adversary.host - adversary.user diff --git a/rules/macos/sudo_caching_abuse.yml b/rules/macos/sudo_caching_abuse.yml index 0165f230f..926866372 100644 --- a/rules/macos/sudo_caching_abuse.yml +++ b/rules/macos/sudo_caching_abuse.yml @@ -22,13 +22,13 @@ description: | 4. Check for sudoers file modifications via visudo or direct editing 5. Review the user account for unauthorized privilege escalation where: | - (contains("log.eventMessage", "sudoers") && - (contains("log.eventMessage", "modified") || contains("log.eventMessage", "syntax error") || - contains("log.eventMessage", "timestamp_timeout"))) || - (contains("log.eventMessage", "sudo") && contains("log.eventMessage", "timestamp") && - (contains("log.eventMessage", "too far in the future") || contains("log.eventMessage", "reset"))) || - (contains("log.eventMessage", "/var/db/sudo") && - (contains("log.eventMessage", "modified") || contains("log.eventMessage", "touch"))) + (contains("log.message", "sudoers") && + (contains("log.message", "modified") || contains("log.message", "syntax error") || + contains("log.message", "timestamp_timeout"))) || + (contains("log.message", "sudo") && contains("log.message", "timestamp") && + (contains("log.message", "too far in the future") || contains("log.message", "reset"))) || + (contains("log.message", "/var/db/sudo") && + (contains("log.message", "modified") || contains("log.message", "touch"))) groupBy: - adversary.host - adversary.user diff --git a/rules/macos/system_integrity_protection_bypass.yml b/rules/macos/system_integrity_protection_bypass.yml index 2c8471fff..5789a1e0e 100644 --- a/rules/macos/system_integrity_protection_bypass.yml +++ b/rules/macos/system_integrity_protection_bypass.yml @@ -15,7 +15,7 @@ references: - https://attack.mitre.org/techniques/T1553/006/ description: | Detects attempts to bypass System Integrity Protection (SIP) through unauthorized modifications to protected locations or suspicious kernel extension loading with rootless entitlements. SIP is a critical security mechanism in macOS that protects system files and processes from modification, even by privileged users. - + Next Steps: 1. Immediately isolate the affected macOS system to prevent further compromise 2. Check SIP status using 'csrutil status' command to verify if it has been disabled @@ -27,21 +27,21 @@ description: | 8. Consider reimaging the system if SIP has been successfully bypassed where: | ( - equals("log.process", "storagekitd") && - contains("log.eventMessage", "com.apple.rootless.install.heritable") + equals("origin.process", "storagekitd") && + contains("log.message", "com.apple.rootless.install.heritable") ) || ( - regexMatch("log.processImagePath", ".*/System/Library/.*") && - regexMatch("log.eventMessage", ".*(csrutil|disable|rootless).*") && - equals("log.eventType", "logEvent") + regexMatch("origin.path", ".*/System/Library/.*") && + regexMatch("log.message", ".*(csrutil|disable|rootless).*") && + (equals("log.eventType", "logEvent") || equals("log.className", "OSLogEntryLog")) ) || ( equals("log.subsystem", "com.apple.kernel") && - regexMatch("log.eventMessage", ".*(SIP|rootless).*bypass.*") + regexMatch("log.message", ".*(SIP|rootless).*bypass.*") ) || ( - regexMatch("log.process", ".*kext.*") && - contains("log.eventMessage", "rootless") + regexMatch("origin.process", ".*kext.*") && + contains("log.message", "rootless") ) groupBy: - adversary.host diff --git a/rules/macos/system_log_clearing.yml b/rules/macos/system_log_clearing.yml index d151bfb4b..7b840a269 100644 --- a/rules/macos/system_log_clearing.yml +++ b/rules/macos/system_log_clearing.yml @@ -25,12 +25,12 @@ description: | 6. Ensure centralized logging is in place to prevent future evidence destruction where: | ( - contains("log.eventMessage", ["rm ", "unlink ", "shred "]) && - contains("log.eventMessage", ["/var/log", "/Library/Logs", "system.log", "install.log", "asl/"]) + contains("log.message", ["rm ", "unlink ", "shred "]) && + contains("log.message", ["/var/log", "/Library/Logs", "system.log", "install.log", "asl/"]) ) || ( - contains("log.eventMessage", "log erase") && - equals("log.process", "log") + contains("log.message", "log erase") && + equals("origin.process", "log") ) groupBy: - adversary.host diff --git a/rules/macos/tcc_database_manipulation.yml b/rules/macos/tcc_database_manipulation.yml index 6a63530e8..b57214392 100644 --- a/rules/macos/tcc_database_manipulation.yml +++ b/rules/macos/tcc_database_manipulation.yml @@ -27,38 +27,38 @@ description: | 7. Consider reimaging the affected system if unauthorized TCC manipulation is confirmed where: | ( - equals("log.process", "tccd") && + equals("origin.process", "tccd") && ( - regexMatch("log.eventMessage", ".*unauthorized.*access.*") || - contains("log.eventMessage", "bypass") || - contains("log.eventMessage", "CVE-2020-9934") + regexMatch("log.message", ".*unauthorized.*access.*") || + contains("log.message", "bypass") || + contains("log.message", "CVE-2020-9934") ) ) || ( - regexMatch("log.processImagePath", ".*/Library/Application Support/com\\.apple\\.TCC/TCC\\.db.*") && - regexMatch("log.eventMessage", ".*(write|modify|INSERT|UPDATE|DELETE).*") && - !equals("log.process", "tccd") + regexMatch("origin.path", ".*/Library/Application Support/com\\.apple\\.TCC/TCC\\.db.*") && + regexMatch("log.message", ".*(write|modify|INSERT|UPDATE|DELETE).*") && + exists("origin.process") && !equals("origin.process", "tccd") ) || ( - contains("log.eventMessage", "TCC.db") && + contains("log.message", "TCC.db") && ( - regexMatch("log.eventMessage", ".*(sqlite3|INSERT INTO|UPDATE|DELETE FROM).*") || - regexMatch("log.eventMessage", ".*(kTCCServiceDeveloperTool|kTCCServiceScreenCapture|kTCCServiceAccessibility).*") + regexMatch("log.message", ".*(sqlite3|INSERT INTO|UPDATE|DELETE FROM).*") || + regexMatch("log.message", ".*(kTCCServiceDeveloperTool|kTCCServiceScreenCapture|kTCCServiceAccessibility).*") ) ) || ( equals("log.subsystem", "com.apple.TCC") && ( - contains("log.eventMessage", "Full Disk Access") || - contains("log.eventMessage", "Screen Recording") || - contains("log.eventMessage", "Accessibility") + contains("log.message", "Full Disk Access") || + contains("log.message", "Screen Recording") || + contains("log.message", "Accessibility") ) && - regexMatch("log.eventMessage", ".*(grant|bypass|override).*") + regexMatch("log.message", ".*(grant|bypass|override).*") ) || ( - exists("log.process") && - regexMatch("log.eventMessage", ".*com\\.apple\\.private\\.tcc\\.manager.*") && - !equals("log.process", "tccd") + exists("origin.process") && + regexMatch("log.message", ".*com\\.apple\\.private\\.tcc\\.manager.*") && + !equals("origin.process", "tccd") ) groupBy: - adversary.host diff --git a/rules/macos/time_machine_backup_deletion.yml b/rules/macos/time_machine_backup_deletion.yml index cbc9d0f0c..a23f398e4 100644 --- a/rules/macos/time_machine_backup_deletion.yml +++ b/rules/macos/time_machine_backup_deletion.yml @@ -24,8 +24,8 @@ description: | 5. Isolate the system from the network if ransomware is suspected 6. Ensure offsite or cloud backups are intact and accessible where: | - contains("log.eventMessage", "tmutil") && - contains("log.eventMessage", "delete") + contains("log.message", "tmutil") && + contains("log.message", "delete") groupBy: - adversary.host - adversary.user diff --git a/rules/macos/wizardupdate_malware.yml b/rules/macos/wizardupdate_malware.yml index 3b2cea8e7..6482d4fb7 100644 --- a/rules/macos/wizardupdate_malware.yml +++ b/rules/macos/wizardupdate_malware.yml @@ -26,12 +26,12 @@ description: | 6. Perform a full malware scan and consider reimaging the system where: | ( - contains("log.eventMessage", "curl") && - contains("log.eventMessage", ["eval", "bash", "sh "]) && - contains("log.eventMessage", ["pipe", "|"]) + contains("log.message", "curl") && + contains("log.message", ["eval", "bash", "sh "]) && + contains("log.message", ["pipe", "|"]) ) || - contains("log.eventMessage", "_intermediate_agent_") || - contains("log.eventMessage", "UpdateAgent") + contains("log.message", "_intermediate_agent_") || + contains("log.message", "UpdateAgent") groupBy: - adversary.host - adversary.user diff --git a/rules/macos/xcsset_malware.yml b/rules/macos/xcsset_malware.yml index 655e68098..6dd4ad93e 100644 --- a/rules/macos/xcsset_malware.yml +++ b/rules/macos/xcsset_malware.yml @@ -27,17 +27,17 @@ description: | 7. Notify other developers who may have cloned affected Xcode projects where: | ( - contains("log.eventMessage", "curl") && - contains("log.eventMessage", "/sys/log.php") + contains("log.message", "curl") && + contains("log.message", "/sys/log.php") ) || ( - contains("log.eventMessage", "osacompile") && - contains("log.eventMessage", "Library/Group Containers") + contains("log.message", "osacompile") && + contains("log.message", "Library/Group Containers") ) || ( - contains("log.eventMessage", "repl") && - contains("log.eventMessage", "Pods") && - contains("log.eventMessage", "xcscheme") + contains("log.message", "repl") && + contains("log.message", "Pods") && + contains("log.message", "xcscheme") ) groupBy: - adversary.host diff --git a/rules/macos/xprotect_evasion.yml b/rules/macos/xprotect_evasion.yml index b01ee8b53..c5d2d0e3a 100644 --- a/rules/macos/xprotect_evasion.yml +++ b/rules/macos/xprotect_evasion.yml @@ -29,34 +29,34 @@ where: | ( equals("log.subsystem", "com.apple.XProtectFramework") && ( - contains("log.eventMessage", "bypass") || - contains("log.eventMessage", "evasion") || - contains("log.eventMessage", "disable") + contains("log.message", "bypass") || + contains("log.message", "evasion") || + contains("log.message", "disable") ) ) || ( - regexMatch("log.processImagePath", ".*/Library/Apple/System/Library/CoreServices/XProtect\\.bundle.*") && - regexMatch("log.eventMessage", ".*(modify|write|delete).*") + regexMatch("origin.path", ".*/Library/Apple/System/Library/CoreServices/XProtect\\.bundle.*") && + regexMatch("log.message", ".*(modify|write|delete).*") ) || ( - regexMatch("log.eventMessage", ".*XProtect\\.(yara|meta\\.plist|bundle).*") && + regexMatch("log.message", ".*XProtect\\.(yara|meta\\.plist|bundle).*") && ( - regexMatch("log.eventMessage", ".*(modify|tamper|delete).*") || - !equals("log.process", "XProtectService") + regexMatch("log.message", ".*(modify|tamper|delete).*") || + (exists("origin.process") && !equals("origin.process", "XProtectService")) ) ) || ( - equals("log.process", "MRT") && - (contains("log.eventMessage", "kill") || contains("log.eventMessage", "terminate") || contains("log.eventMessage", "stop")) + equals("origin.process", "MRT") && + (contains("log.message", "kill") || contains("log.message", "terminate") || contains("log.message", "stop")) ) || ( - regexMatch("log.eventMessage", ".*gk\\.db.*") && - regexMatch("log.eventMessage", ".*(modify|delete|truncate).*") + regexMatch("log.message", ".*gk\\.db.*") && + regexMatch("log.message", ".*(modify|delete|truncate).*") ) || ( equals("log.subsystem", "com.apple.MRT") && - (contains("log.eventMessage", "bypass") || contains("log.eventMessage", "disable") || contains("log.eventMessage", "fail")) + (contains("log.message", "bypass") || contains("log.message", "disable") || contains("log.message", "fail")) ) groupBy: - - lastEvent.log.process + - adversary.process - adversary.host