split and update

SigmaHQ · Aug 10, 2024 · 53e3196 · 53e3196
1 parent 4d6e17c
commit 53e3196
Show file tree

Hide file tree

Showing 2 changed files with 29 additions and 6 deletions.
diff --git a/rules/macos/process_creation/proc_creation_macos_hdiutil_create.yml b/rules/macos/process_creation/proc_creation_macos_hdiutil_create.yml
@@ -0,0 +1,23 @@
+title: Disk Image Creation Via Hdiutil - MacOS
+id: 1cf98dc2-fcb0-47c9-8aea-654c9284d1ae
+status: experimental
+description: Detects the execution of the hdiutil utility in order to create a disk image.
+references:
+    - https://www.loobins.io/binaries/hdiutil/
+    - https://www.sentinelone.com/blog/from-the-front-linesunsigned-macos-orat-malware-gambles-for-the-win/
+    - https://ss64.com/mac/hdiutil.html
+author: Omar Khaled (@beacon_exe)
+date: 2024/08/10
+tags:
+    - attack.exfiltration
+logsource:
+    product: macos
+    category: process_creation
+detection:
+    selection:
+        Image|endswith: /hdiutil
+        CommandLine|contains: 'create'
+    condition: selection
+falsepositives:
+    - Legitimate usage of hdiutil by administrators and users.
+level: medium
diff --git a/...roc_creation_macos_susp_hdiutil_mount.yml → ...ion/proc_creation_macos_hdiutil_mount.yml b/...roc_creation_macos_susp_hdiutil_mount.yml → ...ion/proc_creation_macos_hdiutil_mount.yml
@@ -1,12 +1,13 @@
-title: File Mounting Via hdiutil - MacOS
+title: Disk Image Mounting Via Hdiutil - MacOS
 id: bf241472-f014-4f01-a869-96f99330ca8c
 status: experimental
-description: Detects the execution of the hdiutil utility in order to mount files or exfiltrate data
+description: Detects the execution of the hdiutil utility in order to mount disk images.
 references:
     - https://www.loobins.io/binaries/hdiutil/
-    - https://www.sentinelone.com/blog/from-the-front-lines-unsigned-macos-orat-malware-gambles-for-the-win/
+    - https://www.sentinelone.com/blog/from-the-front-linesunsigned-macos-orat-malware-gambles-for-the-win/
+    - https://ss64.com/mac/hdiutil.html
 author: Omar Khaled (@beacon_exe)
-date: 2024/08/04
+date: 2024/08/10
 tags:
     - attack.initial_access
     - attack.t1566.001
@@ -20,8 +21,7 @@ detection:
         CommandLine|contains:
             - 'attach '
             - 'mount '
-            - 'create '
     condition: selection
 falsepositives:
-    - Legitimate usage of hdiutil by administrators and users
+    - Legitimate usage of hdiutil by administrators and users.
 level: medium