Skip to content

Commit d2111ca

Browse files
tradebot-elastictradebot-elastic
authored
Update latest docs (#6805)
1 parent 5ef1ea9 commit d2111ca

File tree

116 files changed

+9529
-293
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

116 files changed

+9529
-293
lines changed

‎docs/detections/prebuilt-rules/downloadable-packages/8-16-12/prebuilt-rule-8-16-12-apple-script-execution-followed-by-network-connection.asciidoc

Lines changed: 171 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,171 @@
1+
[[prebuilt-rule-8-16-12-apple-script-execution-followed-by-network-connection]]
2+
=== Apple Script Execution followed by Network Connection
3+
4+
Detects execution via the Apple script interpreter (osascript) followed by a network connection from the same process within a short time period. Adversaries may use malicious scripts for execution and command and control.
5+
6+
*Rule type*: eql
7+
8+
*Rule indices*:
9+
10+
* logs-endpoint.events.network*
11+
* logs-endpoint.events.process*
12+
13+
*Severity*: medium
14+
15+
*Risk score*: 47
16+
17+
*Runs every*: 5m
18+
19+
*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
20+
21+
*Maximum alerts per execution*: 100
22+
23+
*References*:
24+
25+
* https://developer.apple.com/library/archive/documentation/LanguagesUtilities/Conceptual/MacAutomationScriptingGuide/index.html
26+
* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
27+
28+
*Tags*:
29+
30+
* Domain: Endpoint
31+
* OS: macOS
32+
* Use Case: Threat Detection
33+
* Tactic: Command and Control
34+
* Tactic: Execution
35+
* Data Source: Elastic Defend
36+
* Resources: Investigation Guide
37+
38+
*Version*: 112
39+
40+
*Rule authors*:
41+
42+
* Elastic
43+
44+
*Rule license*: Elastic License v2
45+
46+
47+
==== Investigation guide
48+
49+
50+
51+
*Triage and analysis*
52+
53+
54+
> **Disclaimer**:
55+
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
56+
57+
58+
*Investigating Apple Script Execution followed by Network Connection*
59+
60+
61+
AppleScript, a scripting language for macOS, automates tasks by controlling applications and system functions. Adversaries exploit it to execute scripts that establish unauthorized network connections, facilitating command and control activities. The detection rule identifies such abuse by monitoring the osascript process for script execution followed by network activity, excluding local and private IP ranges, within a short timeframe.
62+
63+
64+
*Possible investigation steps*
65+
66+
67+
- Review the process details for the osascript execution event, focusing on the process.entity_id and host.id to understand the context of the script execution.
68+
- Examine the network connection details associated with the osascript process, particularly the destination IP address, to determine if it is known or suspicious, and check if it falls outside the excluded IP ranges.
69+
- Investigate the script content or command line arguments used in the osascript execution to identify any potentially malicious or unexpected behavior.
70+
- Check the timeline of events to see if there are any other related or suspicious activities occurring on the same host around the time of the osascript execution and network connection.
71+
- Correlate the osascript activity with any other alerts or logs from the same host to identify patterns or additional indicators of compromise.
72+
- Assess the user account associated with the osascript process to determine if it is a legitimate user or if there are signs of account compromise.
73+
74+
75+
*False positive analysis*
76+
77+
78+
- Legitimate automation scripts may trigger the rule if they execute osascript and establish network connections. Review the script's purpose and source to determine if it is authorized.
79+
- System management tools that use AppleScript for remote administration can cause false positives. Identify these tools and consider creating exceptions for their known processes.
80+
- Software updates or applications that use AppleScript for network communication might be flagged. Verify the application's legitimacy and update the rule to exclude these specific processes or IP addresses.
81+
- Development environments that utilize AppleScript for testing or deployment may inadvertently match the rule. Ensure these environments are recognized and excluded from monitoring if they are trusted.
82+
- Regularly review and update the list of excluded IP ranges and processes to ensure they reflect the current network and application landscape, minimizing unnecessary alerts.
83+
84+
85+
*Response and remediation*
86+
87+
88+
- Immediately isolate the affected macOS host from the network to prevent further unauthorized access or data exfiltration.
89+
- Terminate the osascript process identified in the alert to stop any ongoing malicious activity.
90+
- Conduct a thorough review of the executed AppleScript to identify any malicious commands or payloads and remove any associated files or scripts from the system.
91+
- Reset credentials for any accounts that were accessed or could have been compromised during the incident.
92+
- Apply security patches and updates to the macOS system to address any vulnerabilities that may have been exploited.
93+
- Monitor network traffic for any further suspicious activity originating from the affected host or similar patterns across other systems.
94+
- Escalate the incident to the security operations team for further investigation and to determine if additional systems have been compromised.
95+
96+
==== Setup
97+
98+
99+
100+
*Setup*
101+
102+
103+
This rule requires data coming in from Elastic Defend.
104+
105+
106+
*Elastic Defend Integration Setup*
107+
108+
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
109+
110+
111+
*Prerequisite Requirements:*
112+
113+
- Fleet is required for Elastic Defend.
114+
- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
115+
116+
117+
*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
118+
119+
- Go to the Kibana home page and click "Add integrations".
120+
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
121+
- Click "Add Elastic Defend".
122+
- Configure the integration name and optionally add a description.
123+
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
124+
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
125+
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
126+
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
127+
For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
128+
- Click "Save and Continue".
129+
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
130+
For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
131+
132+
133+
==== Rule query
134+
135+
136+
[source, js]
137+
----------------------------------
138+
sequence by host.id, process.entity_id with maxspan=30s
139+
[process where host.os.type == "macos" and event.type == "start" and process.name == "osascript"]
140+
[network where host.os.type == "macos" and event.type == "start" and process.name == "osascript" and
141+
not cidrmatch(destination.ip,
142+
"240.0.0.0/4", "233.252.0.0/24", "224.0.0.0/4", "198.19.0.0/16", "192.18.0.0/15",
143+
"192.0.0.0/24", "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12",
144+
"192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24",
145+
"100.64.0.0/10", "192.175.48.0/24", "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24",
146+
"::1", "FE80::/10", "FF00::/8")]
147+
148+
----------------------------------
149+
150+
*Framework*: MITRE ATT&CK^TM^
151+
152+
* Tactic:
153+
** Name: Execution
154+
** ID: TA0002
155+
** Reference URL: https://attack.mitre.org/tactics/TA0002/
156+
* Technique:
157+
** Name: Command and Scripting Interpreter
158+
** ID: T1059
159+
** Reference URL: https://attack.mitre.org/techniques/T1059/
160+
* Sub-technique:
161+
** Name: AppleScript
162+
** ID: T1059.002
163+
** Reference URL: https://attack.mitre.org/techniques/T1059/002/
164+
* Tactic:
165+
** Name: Command and Control
166+
** ID: TA0011
167+
** Reference URL: https://attack.mitre.org/tactics/TA0011/
168+
* Technique:
169+
** Name: Ingress Tool Transfer
170+
** ID: T1105
171+
** Reference URL: https://attack.mitre.org/techniques/T1105/

‎docs/detections/prebuilt-rules/downloadable-packages/8-16-12/prebuilt-rule-8-16-12-apple-scripting-execution-with-administrator-privileges.asciidoc

Lines changed: 158 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,158 @@
1+
[[prebuilt-rule-8-16-12-apple-scripting-execution-with-administrator-privileges]]
2+
=== Apple Scripting Execution with Administrator Privileges
3+
4+
Identifies execution of the Apple script interpreter (osascript) without a password prompt and with administrator privileges.
5+
6+
*Rule type*: eql
7+
8+
*Rule indices*:
9+
10+
* logs-endpoint.events.process*
11+
12+
*Severity*: medium
13+
14+
*Risk score*: 47
15+
16+
*Runs every*: 5m
17+
18+
*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
19+
20+
*Maximum alerts per execution*: 100
21+
22+
*References*:
23+
24+
* https://discussions.apple.com/thread/2266150
25+
26+
*Tags*:
27+
28+
* Domain: Endpoint
29+
* OS: macOS
30+
* Use Case: Threat Detection
31+
* Tactic: Execution
32+
* Tactic: Privilege Escalation
33+
* Data Source: Elastic Defend
34+
* Resources: Investigation Guide
35+
36+
*Version*: 212
37+
38+
*Rule authors*:
39+
40+
* Elastic
41+
42+
*Rule license*: Elastic License v2
43+
44+
45+
==== Investigation guide
46+
47+
48+
49+
*Triage and analysis*
50+
51+
52+
> **Disclaimer**:
53+
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
54+
55+
56+
*Investigating Apple Scripting Execution with Administrator Privileges*
57+
58+
59+
AppleScript, a scripting language for macOS, automates tasks by controlling applications and system functions. Adversaries may exploit it to execute scripts with elevated privileges, bypassing password prompts, to gain unauthorized access or escalate privileges. The detection rule identifies such misuse by monitoring the execution of AppleScript with admin rights, excluding benign parent processes like Electron, to flag potential threats.
60+
61+
62+
*Possible investigation steps*
63+
64+
65+
- Review the process details to confirm the execution of 'osascript' with administrator privileges, focusing on the command line arguments to understand the script's intent.
66+
- Investigate the parent process of 'osascript' to determine if it is a known and trusted application, ensuring it is not 'Electron' or any other excluded parent processes.
67+
- Check the user account associated with the 'osascript' execution to verify if it is a legitimate account and assess if there are any signs of compromise or unauthorized access.
68+
- Analyze recent system logs and user activity to identify any unusual behavior or patterns that coincide with the time of the alert.
69+
- Correlate this event with other security alerts or incidents to determine if it is part of a broader attack or isolated incident.
70+
71+
72+
*False positive analysis*
73+
74+
75+
- Known false positives may arise from legitimate applications that use AppleScript with administrator privileges for valid operations, such as software installers or system management tools.
76+
- Exclude processes with benign parent applications like Electron, as specified in the rule, to reduce false positives from common development environments.
77+
- Consider adding exceptions for other trusted applications that frequently use AppleScript with elevated privileges, ensuring they are verified and necessary for business operations.
78+
- Regularly review and update the list of excluded applications to adapt to changes in software usage and maintain effective threat detection.
79+
- Monitor the frequency and context of alerts to identify patterns that may indicate false positives, adjusting the detection rule as needed to minimize unnecessary alerts.
80+
81+
82+
*Response and remediation*
83+
84+
85+
- Immediately isolate the affected macOS system from the network to prevent further unauthorized access or lateral movement.
86+
- Terminate any suspicious osascript processes running with administrator privileges that were not initiated by known, legitimate applications.
87+
- Review system logs and process execution history to identify any unauthorized changes or access that occurred during the incident.
88+
- Revoke any compromised credentials or accounts that may have been used to execute the AppleScript with elevated privileges.
89+
- Restore the system to a known good state from a backup taken before the unauthorized script execution, if necessary.
90+
- Implement application whitelisting to prevent unauthorized scripts from executing with elevated privileges in the future.
91+
- Escalate the incident to the security operations team for further investigation and to assess the need for additional security controls or monitoring enhancements.
92+
93+
==== Setup
94+
95+
96+
97+
*Setup*
98+
99+
100+
This rule requires data coming in from Elastic Defend.
101+
102+
103+
*Elastic Defend Integration Setup*
104+
105+
Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
106+
107+
108+
*Prerequisite Requirements:*
109+
110+
- Fleet is required for Elastic Defend.
111+
- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
112+
113+
114+
*The following steps should be executed in order to add the Elastic Defend integration on a macOS System:*
115+
116+
- Go to the Kibana home page and click "Add integrations".
117+
- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
118+
- Click "Add Elastic Defend".
119+
- Configure the integration name and optionally add a description.
120+
- Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
121+
- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
122+
- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
123+
- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
124+
For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/current/agent-policy.html[helper guide].
125+
- Click "Save and Continue".
126+
- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
127+
For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
128+
129+
130+
==== Rule query
131+
132+
133+
[source, js]
134+
----------------------------------
135+
process where host.os.type == "macos" and event.type in ("start", "process_started") and process.name == "osascript" and
136+
process.command_line : "osascript*with administrator privileges" and
137+
((process.parent.code_signature.trusted == false or process.parent.code_signature.exists == false) or process.Ext.effective_parent.executable like ("/tmp/*", "/private/tmp/*", "/Users/Shared/*"))
138+
139+
----------------------------------
140+
141+
*Framework*: MITRE ATT&CK^TM^
142+
143+
* Tactic:
144+
** Name: Privilege Escalation
145+
** ID: TA0004
146+
** Reference URL: https://attack.mitre.org/tactics/TA0004/
147+
* Technique:
148+
** Name: Valid Accounts
149+
** ID: T1078
150+
** Reference URL: https://attack.mitre.org/techniques/T1078/
151+
* Tactic:
152+
** Name: Execution
153+
** ID: TA0002
154+
** Reference URL: https://attack.mitre.org/tactics/TA0002/
155+
* Technique:
156+
** Name: Command and Scripting Interpreter
157+
** ID: T1059
158+
** Reference URL: https://attack.mitre.org/techniques/T1059/

0 commit comments

Comments
 (0)