[rule]
description = """
Identifies the Osascript process accessing the Kerberos configuration file. Adversaries may attempt to access this file
in order to gain situational awareness regarding the Active Directory domain to include its structure and settings.
"""
id = "ac72d6b3-c647-42e3-bafc-03ccf3180204"
license = "Elastic License v2"
name = "Kerberos Config File Accessed by Osascript"
os_list = ["macos"]
version = "1.0.6"
query = '''
file where event.action == "open" and
file.path like "/etc/krb5.conf" and
process.name == "osascript"
'''
min_endpoint_version = "8.11.1"
optional_actions = []
[[actions]]
action = "kill_process"
field = "Effective_process.executable"
state = 0
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.002"
name = "AppleScript"
reference = "https://attack.mitre.org/techniques/T1059/002/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1082"
name = "System Information Discovery"
reference = "https://attack.mitre.org/techniques/T1082/"
[threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"
[internal]
min_endpoint_version = "8.11.1"