CrowdStrike MacOS Added Trusted Cert

Description

Detects attempt to install a root certificate on MacOS

Query · python

from panther_crowdstrike_fdr_helpers import crowdstrike_process_alert_context


def rule(event):
    event_platform = event.get("event_platform", "<UNKNOWN_PLATFORM>")
    fdr_event_type = event.get("fdr_event_type", "<UNKNOWN_FDR_EVENT_TYPE>")
    image_filename = event.deep_get("event", "ImageFileName", default="<UNKNOWN_IMAGE_FILE_NAME>")
    command_line = event.deep_get("event", "CommandLine", default="<UNKNOWN_COMMAND_LINE>")
    return all(
        [
            event_platform == "Mac",
            fdr_event_type == "ProcessRollup2",
            image_filename == "/usr/bin/security",
            "add-trusted-cert" in command_line,
        ]
    )


def title(event):
    host = event.get("ComputerName") or event.get("aid", "<AID_NOT_FOUND>")
    return f"Crowdstrike: New trusted cert added on device [{host}]"


def alert_context(event):
    return crowdstrike_process_alert_context(event)
Raw source CrowdStrike MacOS Added Trusted Cert · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: rule
DisplayName: CrowdStrike MacOS Added Trusted Cert
Description: Detects attempt to install a root certificate on MacOS
Enabled: true
Filename: crowdstrike_macos_add_trusted_cert.py
RuleID: Crowdstrike.Macos.Add.Trusted.Cert
Reference: https://docs.panther.com/data-onboarding/supported-logs/crowdstrike#crowdstrike.processrollup2
Severity: Medium
LogTypes:
  - Crowdstrike.FDREvent
Tests:
  - Name: Added root cert
    ExpectedResult: true
    Log:
      {
        "aid": "1234abcdefghijklmnop",
        "aip": "1.2.3.4",
        "cid": "abcde098654321xyz",
        "configbuild": "1007.4.0016804.11",
        "configstatehash": "1260279761",
        "entitlements": "15",
        "event":
          {
            "CodeSigningFlags": "570506001",
            "CommandLine": "security add-trusted-cert -d -r trusted",
            "ConfigBuild": "1007.4.0016804.11",
            "ConfigStateHash": "1260279761",
            "EffectiveTransmissionClass": "2",
            "Entitlements": "15",
            "GID": "20",
            "ImageFileName": "/usr/bin/security",
            "MD5HashData": "5a29b1ee210395604829dafd744a8039",
            "MachOSubType": "1",
            "ParentBaseFileName": "zsh",
            "ParentProcessId": "488592041865603507",
            "ProcessEndTime": "",
            "ProcessGroupId": "488638905187012012",
            "ProcessStartTime": "1685123957.068",
            "RGID": "501",
            "RUID": "501",
            "RawProcessId": "51673",
            "SHA1HashData": "0000000000000000000000000000000000000000",
            "SHA256HashData": "fc708414b7e7c0df8d7711d0362b4dbd79a45fba65bdc646848fa8f50e9035de",
            "SVGID": "20",
            "SVUID": "501",
            "SessionProcessId": "488592041748162994",
            "SigningId": "com.apple.Foundation.plutil",
            "SourceProcessId": "488592041865603507",
            "SourceThreadId": "0",
            "Tags": "316",
            "TargetProcessId": "488638905187012012",
            "TeamId": "-",
            "UID": "501",
            "aid": "1234abcdefghijklmnop",
            "aip": "1.2.3.4",
            "cid": "abcde098654321xyz",
            "event_platform": "Mac",
            "event_simpleName": "ProcessRollup2",
            "id": "59c9d5fb-b9b7-43a3-913f-6df72d9e1969",
            "name": "ProcessRollup2MacV9",
            "timestamp": "1685123957235",
          },
        "event_platform": "Mac",
        "event_simplename": "ProcessRollup2",
        "fdr_event_type": "ProcessRollup2",
        "id": "59c9d5fb-b9b7-43a3-913f-6df72d9e1969",
        "name": "ProcessRollup2MacV9",
        "p_any_ip_addresses": ["1.2.3.4"],
        "p_any_md5_hashes":
          [
            "1234abcdefghijklmnop",
            "5a29b1ee210395604829dafd744a8039",
            "abcde098654321xyz",
          ],
        "p_any_sha1_hashes": ["0000000000000000000000000000000000000000"],
        "p_any_sha256_hashes":
          ["fc708414b7e7c0df8d7711d0362b4dbd79a45fba65bdc646848fa8f50e9035de"],
        "p_any_trace_ids": ["1234abcdefghijklmnop", "abcde098654321xyz"],
        "p_event_time": "2023-05-26 17:59:17.235",
        "p_log_type": "Crowdstrike.FDREvent",
        "p_parse_time": "2023-05-26 18:11:03.404",
        "p_row_id": "d6ff1555b3f6e785b3e2bbb218abf524",
        "p_schema_version": 0,
        "p_source_id": "e4962678-a986-44af-a757-18163a2bc963",
        "p_source_label": "Crowdstrike",
        "timestamp": "2023-05-26 17:59:17.235",
      }
  - Name: Windows log
    ExpectedResult: false
    Log:
      {
        "aid": "1234abcdefghijklmnop",
        "aip": "1.2.3.4",
        "cid": "abcde098654321xyz",
        "configbuild": "1007.4.0016804.11",
        "configstatehash": "1260279761",
        "entitlements": "15",
        "event":
          {
            "CodeSigningFlags": "570506001",
            "CommandLine": "security add-trusted-cert -d -r trusted",
            "ConfigBuild": "1007.4.0016804.11",
            "ConfigStateHash": "1260279761",
            "EffectiveTransmissionClass": "2",
            "Entitlements": "15",
            "GID": "20",
            "ImageFileName": "/usr/bin/security",
            "MD5HashData": "5a29b1ee210395604829dafd744a8039",
            "MachOSubType": "1",
            "ParentBaseFileName": "zsh",
            "ParentProcessId": "488592041865603507",
            "ProcessEndTime": "",
            "ProcessGroupId": "488638905187012012",
            "ProcessStartTime": "1685123957.068",
            "RGID": "501",
            "RUID": "501",
            "RawProcessId": "51673",
            "SHA1HashData": "0000000000000000000000000000000000000000",
            "SHA256HashData": "fc708414b7e7c0df8d7711d0362b4dbd79a45fba65bdc646848fa8f50e9035de",
            "SVGID": "20",
            "SVUID": "501",
            "SessionProcessId": "488592041748162994",
            "SigningId": "com.apple.Foundation.plutil",
            "SourceProcessId": "488592041865603507",
            "SourceThreadId": "0",
            "Tags": "316",
            "TargetProcessId": "488638905187012012",
            "TeamId": "-",
            "UID": "501",
            "aid": "1234abcdefghijklmnop",
            "aip": "1.2.3.4",
            "cid": "abcde098654321xyz",
            "event_platform": "Mac",
            "event_simpleName": "ProcessRollup2",
            "id": "59c9d5fb-b9b7-43a3-913f-6df72d9e1969",
            "name": "ProcessRollup2MacV9",
            "timestamp": "1685123957235",
          },
        "event_platform": "Win",
        "event_simplename": "ProcessRollup2",
        "fdr_event_type": "ProcessRollup2",
        "id": "59c9d5fb-b9b7-43a3-913f-6df72d9e1969",
        "name": "ProcessRollup2MacV9",
        "p_any_ip_addresses": ["1.2.3.4"],
        "p_any_md5_hashes":
          [
            "1234abcdefghijklmnop",
            "5a29b1ee210395604829dafd744a8039",
            "abcde098654321xyz",
          ],
        "p_any_sha1_hashes": ["0000000000000000000000000000000000000000"],
        "p_any_sha256_hashes":
          ["fc708414b7e7c0df8d7711d0362b4dbd79a45fba65bdc646848fa8f50e9035de"],
        "p_any_trace_ids": ["1234abcdefghijklmnop", "abcde098654321xyz"],
        "p_event_time": "2023-05-26 17:59:17.235",
        "p_log_type": "Crowdstrike.FDREvent",
        "p_parse_time": "2023-05-26 18:11:03.404",
        "p_row_id": "d6ff1555b3f6e785b3e2bbb218abf524",
        "p_schema_version": 0,
        "p_source_id": "e4962678-a986-44af-a757-18163a2bc963",
        "p_source_label": "Crowdstrike",
        "timestamp": "2023-05-26 17:59:17.235",
      }
  - Name: Wrong FDR event type
    ExpectedResult: false
    Log:
      {
        "aid": "1234abcdefghijklmnop",
        "aip": "1.2.3.4",
        "cid": "abcde098654321xyz",
        "configbuild": "1007.4.0016804.11",
        "configstatehash": "1260279761",
        "entitlements": "15",
        "event":
          {
            "CodeSigningFlags": "570506001",
            "CommandLine": "security add-trusted-cert -d -r trusted",
            "ConfigBuild": "1007.4.0016804.11",
            "ConfigStateHash": "1260279761",
            "EffectiveTransmissionClass": "2",
            "Entitlements": "15",
            "GID": "20",
            "ImageFileName": "/usr/bin/security",
            "MD5HashData": "5a29b1ee210395604829dafd744a8039",
            "MachOSubType": "1",
            "ParentBaseFileName": "zsh",
            "ParentProcessId": "488592041865603507",
            "ProcessEndTime": "",
            "ProcessGroupId": "488638905187012012",
            "ProcessStartTime": "1685123957.068",
            "RGID": "501",
            "RUID": "501",
            "RawProcessId": "51673",
            "SHA1HashData": "0000000000000000000000000000000000000000",
            "SHA256HashData": "fc708414b7e7c0df8d7711d0362b4dbd79a45fba65bdc646848fa8f50e9035de",
            "SVGID": "20",
            "SVUID": "501",
            "SessionProcessId": "488592041748162994",
            "SigningId": "com.apple.Foundation.plutil",
            "SourceProcessId": "488592041865603507",
            "SourceThreadId": "0",
            "Tags": "316",
            "TargetProcessId": "488638905187012012",
            "TeamId": "-",
            "UID": "501",
            "aid": "1234abcdefghijklmnop",
            "aip": "1.2.3.4",
            "cid": "abcde098654321xyz",
            "event_platform": "Mac",
            "event_simpleName": "ProcessRollup2",
            "id": "59c9d5fb-b9b7-43a3-913f-6df72d9e1969",
            "name": "ProcessRollup2MacV9",
            "timestamp": "1685123957235",
          },
        "event_platform": "Mac",
        "event_simplename": "DnsRequest",
        "fdr_event_type": "DnsRequest",
        "id": "59c9d5fb-b9b7-43a3-913f-6df72d9e1969",
        "name": "ProcessRollup2MacV9",
        "p_any_ip_addresses": ["1.2.3.4"],
        "p_any_md5_hashes":
          [
            "1234abcdefghijklmnop",
            "5a29b1ee210395604829dafd744a8039",
            "abcde098654321xyz",
          ],
        "p_any_sha1_hashes": ["0000000000000000000000000000000000000000"],
        "p_any_sha256_hashes":
          ["fc708414b7e7c0df8d7711d0362b4dbd79a45fba65bdc646848fa8f50e9035de"],
        "p_any_trace_ids": ["1234abcdefghijklmnop", "abcde098654321xyz"],
        "p_event_time": "2023-05-26 17:59:17.235",
        "p_log_type": "Crowdstrike.FDREvent",
        "p_parse_time": "2023-05-26 18:11:03.404",
        "p_row_id": "d6ff1555b3f6e785b3e2bbb218abf524",
        "p_schema_version": 0,
        "p_source_id": "e4962678-a986-44af-a757-18163a2bc963",
        "p_source_label": "Crowdstrike",
        "timestamp": "2023-05-26 17:59:17.235",
      }
  - Name: Wrong executable path
    ExpectedResult: false
    Log:
      {
        "aid": "1234abcdefghijklmnop",
        "aip": "1.2.3.4",
        "cid": "abcde098654321xyz",
        "configbuild": "1007.4.0016804.11",
        "configstatehash": "1260279761",
        "entitlements": "15",
        "event":
          {
            "CodeSigningFlags": "570506001",
            "CommandLine": "security add-trusted-cert -d -r trusted",
            "ConfigBuild": "1007.4.0016804.11",
            "ConfigStateHash": "1260279761",
            "EffectiveTransmissionClass": "2",
            "Entitlements": "15",
            "GID": "20",
            "ImageFileName": "/home/test/bin/security",
            "MD5HashData": "5a29b1ee210395604829dafd744a8039",
            "MachOSubType": "1",
            "ParentBaseFileName": "zsh",
            "ParentProcessId": "488592041865603507",
            "ProcessEndTime": "",
            "ProcessGroupId": "488638905187012012",
            "ProcessStartTime": "1685123957.068",
            "RGID": "501",
            "RUID": "501",
            "RawProcessId": "51673",
            "SHA1HashData": "0000000000000000000000000000000000000000",
            "SHA256HashData": "fc708414b7e7c0df8d7711d0362b4dbd79a45fba65bdc646848fa8f50e9035de",
            "SVGID": "20",
            "SVUID": "501",
            "SessionProcessId": "488592041748162994",
            "SigningId": "com.apple.Foundation.plutil",
            "SourceProcessId": "488592041865603507",
            "SourceThreadId": "0",
            "Tags": "316",
            "TargetProcessId": "488638905187012012",
            "TeamId": "-",
            "UID": "501",
            "aid": "1234abcdefghijklmnop",
            "aip": "1.2.3.4",
            "cid": "abcde098654321xyz",
            "event_platform": "Mac",
            "event_simpleName": "ProcessRollup2",
            "id": "59c9d5fb-b9b7-43a3-913f-6df72d9e1969",
            "name": "ProcessRollup2MacV9",
            "timestamp": "1685123957235",
          },
        "event_platform": "Mac",
        "event_simplename": "ProcessRollup2",
        "fdr_event_type": "ProcessRollup2",
        "id": "59c9d5fb-b9b7-43a3-913f-6df72d9e1969",
        "name": "ProcessRollup2MacV9",
        "p_any_ip_addresses": ["1.2.3.4"],
        "p_any_md5_hashes":
          [
            "1234abcdefghijklmnop",
            "5a29b1ee210395604829dafd744a8039",
            "abcde098654321xyz",
          ],
        "p_any_sha1_hashes": ["0000000000000000000000000000000000000000"],
        "p_any_sha256_hashes":
          ["fc708414b7e7c0df8d7711d0362b4dbd79a45fba65bdc646848fa8f50e9035de"],
        "p_any_trace_ids": ["1234abcdefghijklmnop", "abcde098654321xyz"],
        "p_event_time": "2023-05-26 17:59:17.235",
        "p_log_type": "Crowdstrike.FDREvent",
        "p_parse_time": "2023-05-26 18:11:03.404",
        "p_row_id": "d6ff1555b3f6e785b3e2bbb218abf524",
        "p_schema_version": 0,
        "p_source_id": "e4962678-a986-44af-a757-18163a2bc963",
        "p_source_label": "Crowdstrike",
        "timestamp": "2023-05-26 17:59:17.235",
      }
  - Name: Help command
    ExpectedResult: false
    Log:
      {
        "aid": "1234abcdefghijklmnop",
        "aip": "1.2.3.4",
        "cid": "abcde098654321xyz",
        "configbuild": "1007.4.0016804.11",
        "configstatehash": "1260279761",
        "entitlements": "15",
        "event":
          {
            "CodeSigningFlags": "570506001",
            "CommandLine": "security help",
            "ConfigBuild": "1007.4.0016804.11",
            "ConfigStateHash": "1260279761",
            "EffectiveTransmissionClass": "2",
            "Entitlements": "15",
            "GID": "20",
            "ImageFileName": "/usr/bin/security",
            "MD5HashData": "5a29b1ee210395604829dafd744a8039",
            "MachOSubType": "1",
            "ParentBaseFileName": "zsh",
            "ParentProcessId": "488592041865603507",
            "ProcessEndTime": "",
            "ProcessGroupId": "488638905187012012",
            "ProcessStartTime": "1685123957.068",
            "RGID": "501",
            "RUID": "501",
            "RawProcessId": "51673",
            "SHA1HashData": "0000000000000000000000000000000000000000",
            "SHA256HashData": "fc708414b7e7c0df8d7711d0362b4dbd79a45fba65bdc646848fa8f50e9035de",
            "SVGID": "20",
            "SVUID": "501",
            "SessionProcessId": "488592041748162994",
            "SigningId": "com.apple.Foundation.plutil",
            "SourceProcessId": "488592041865603507",
            "SourceThreadId": "0",
            "Tags": "316",
            "TargetProcessId": "488638905187012012",
            "TeamId": "-",
            "UID": "501",
            "aid": "1234abcdefghijklmnop",
            "aip": "1.2.3.4",
            "cid": "abcde098654321xyz",
            "event_platform": "Mac",
            "event_simpleName": "ProcessRollup2",
            "id": "59c9d5fb-b9b7-43a3-913f-6df72d9e1969",
            "name": "ProcessRollup2MacV9",
            "timestamp": "1685123957235",
          },
        "event_platform": "Mac",
        "event_simplename": "ProcessRollup2",
        "fdr_event_type": "ProcessRollup2",
        "id": "59c9d5fb-b9b7-43a3-913f-6df72d9e1969",
        "name": "ProcessRollup2MacV9",
        "p_any_ip_addresses": ["1.2.3.4"],
        "p_any_md5_hashes":
          [
            "1234abcdefghijklmnop",
            "5a29b1ee210395604829dafd744a8039",
            "abcde098654321xyz",
          ],
        "p_any_sha1_hashes": ["0000000000000000000000000000000000000000"],
        "p_any_sha256_hashes":
          ["fc708414b7e7c0df8d7711d0362b4dbd79a45fba65bdc646848fa8f50e9035de"],
        "p_any_trace_ids": ["1234abcdefghijklmnop", "abcde098654321xyz"],
        "p_event_time": "2023-05-26 17:59:17.235",
        "p_log_type": "Crowdstrike.FDREvent",
        "p_parse_time": "2023-05-26 18:11:03.404",
        "p_row_id": "d6ff1555b3f6e785b3e2bbb218abf524",
        "p_schema_version": 0,
        "p_source_id": "e4962678-a986-44af-a757-18163a2bc963",
        "p_source_label": "Crowdstrike",
        "timestamp": "2023-05-26 17:59:17.235",
      }


# ------ paired body: crowdstrike_macos_add_trusted_cert.py ------

from panther_crowdstrike_fdr_helpers import crowdstrike_process_alert_context


def rule(event):
    event_platform = event.get("event_platform", "<UNKNOWN_PLATFORM>")
    fdr_event_type = event.get("fdr_event_type", "<UNKNOWN_FDR_EVENT_TYPE>")
    image_filename = event.deep_get("event", "ImageFileName", default="<UNKNOWN_IMAGE_FILE_NAME>")
    command_line = event.deep_get("event", "CommandLine", default="<UNKNOWN_COMMAND_LINE>")
    return all(
        [
            event_platform == "Mac",
            fdr_event_type == "ProcessRollup2",
            image_filename == "/usr/bin/security",
            "add-trusted-cert" in command_line,
        ]
    )


def title(event):
    host = event.get("ComputerName") or event.get("aid", "<AID_NOT_FOUND>")
    return f"Crowdstrike: New trusted cert added on device [{host}]"


def alert_context(event):
    return crowdstrike_process_alert_context(event)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.