MacOceanLotusDropper

Description

Backdoor processes associated with OceanLotus Mac malware backdoor dropper. References:. Https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-backdoor-linked-to-oceanlotus-found/. OS Platforms: Macintosh.

Query · kql

DeviceProcessEvents
| where Timestamp > ago(14d)
| where ProcessCommandLine contains "theme0" 
| project Timestamp, DeviceId , DeviceName, AccountName , AccountSid , InitiatingProcessCommandLine , ProcessCommandLine  
| top 100 by Timestamp
Raw source MacOceanLotusDropper · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 1b7f5ba1-6712-4d74-ab88-182932b6af0d
name: MacOceanLotusDropper
description: |
  Backdoor processes associated with OceanLotus Mac malware backdoor dropper.
  References:.
  Https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-backdoor-linked-to-oceanlotus-found/.
  OS Platforms: Macintosh.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
query: |
  DeviceProcessEvents
  | where Timestamp > ago(14d)
  | where ProcessCommandLine contains "theme0" 
  | project Timestamp, DeviceId , DeviceName, AccountName , AccountSid , InitiatingProcessCommandLine , ProcessCommandLine  
  | top 100 by Timestamp

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.