MacOceanLotusBackdoor

Description

Backdoor processes associated with OceanLotus Mac Malware Backdoor. References:. Https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-backdoor-linked-to-oceanlotus-found/. OS platforms: Macintosh.

Query · kql

DeviceProcessEvents
| where Timestamp > ago(14d)
| where FileName in~ ("screenassistantd","spellagentd")
| top 100 by Timestamp
Raw source MacOceanLotusBackdoor · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 02b7dd9d-397a-4726-9761-1130b663f8cf
name: MacOceanLotusBackdoor
description: |
  Backdoor processes associated with OceanLotus Mac Malware Backdoor.
  References:.
  Https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-backdoor-linked-to-oceanlotus-found/.
  OS platforms: Macintosh.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
query: |
  DeviceProcessEvents
  | where Timestamp > ago(14d)
  | where FileName in~ ("screenassistantd","spellagentd")
  | top 100 by Timestamp

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.