At Job Creation or Modification via Shell Command


Description

Detects the creation or modification of an At job by a suspicious process. This activity should almost never take place as Apple is slowly deprecating it and atrun execution is disabled by default. If this rule fires it should indicate highly abnormal or malicious activity. Threat actors can abuse the atrun scheduler to persist their binaries on a system.

Query · eql

sequence by process.entity_id with maxspan=5s
[process where event.type == "start" and (process.name in ("bash", "sh", "zsh", "dash", "csh", "tcsh", "ksh", "tclsh", "fish") or process.name like "tclsh*") and process.args == "-c"]
[file where event.action != "deletion" and 
  file.path like "/private/var/at/jobs/*" and not
  file.path == "/private/var/at/jobs/root"]
Raw source At Job Creation or Modification via Shell Command · Elastic TOML
Esc
Published by elastic/protections-artifacts ↗, licensed under Elastic License 2.0 ↗. Reproduced here unmodified.
[rule]
description = """
Detects the creation or modification of an At job by a suspicious process. This activity should almost never take place
as Apple is slowly deprecating it and atrun execution is disabled by default. If this rule fires it should indicate
highly abnormal or malicious activity. Threat actors can abuse the atrun scheduler to persist their binaries on a
system.
"""
id = "779f18ce-1457-457c-80e1-3a5d146c2dc0"
license = "Elastic License v2"
name = "At Job Creation or Modification via Shell Command"
os_list = ["macos"]
reference = ["https://theevilbit.github.io/beyond/beyond_0014/"]
version = "1.0.23"

query = '''
sequence by process.entity_id with maxspan=5s
[process where event.type == "start" and (process.name in ("bash", "sh", "zsh", "dash", "csh", "tcsh", "ksh", "tclsh", "fish") or process.name like "tclsh*") and process.args == "-c"]
[file where event.action != "deletion" and 
  file.path like "/private/var/at/jobs/*" and not
  file.path == "/private/var/at/jobs/root"]
'''

min_endpoint_version = "8.11.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1053"
name = "Scheduled Task/Job"
reference = "https://attack.mitre.org/techniques/T1053/"
[[threat.technique.subtechnique]]
id = "T1053.002"
name = "At"
reference = "https://attack.mitre.org/techniques/T1053/002/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1053"
name = "Scheduled Task/Job"
reference = "https://attack.mitre.org/techniques/T1053/"
[[threat.technique.subtechnique]]
id = "T1053.002"
name = "At"
reference = "https://attack.mitre.org/techniques/T1053/002/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[internal]
min_endpoint_version = "8.11.0"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.