{"id":"10227522-8429-47e6-a301-f2b2d014e7ad","title":"Macos Remote System Discovery","description":"Detects the enumeration of other remote systems.","author":"Alejandro Ortuno, oscd.community","status":"test","level":"informational","date":"2020-10-22","modified":"2021-11-27","tags":["attack.discovery","attack.t1018"],"technique_ids":["T1018"],"logsource":{"category":"process_creation","product":"macos"},"falsepositives":["Legitimate administration activities"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md"],"source_path":"rules/macos/process_creation/proc_creation_macos_remote_system_discovery.yml","source_sha256":"abf5443667fd7fe7c332791ef360c142cd75424bdb20d15d80cdb7ac92a1e28c","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_remote_system_discovery.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Macos Remote System Discovery\nid: 10227522-8429-47e6-a301-f2b2d014e7ad\nstatus: test\ndescription: Detects the enumeration of other remote systems.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md\nauthor: Alejandro Ortuno, oscd.community\ndate: 2020-10-22\nmodified: 2021-11-27\ntags:\n    - attack.discovery\n    - attack.t1018\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection_1:\n        Image|endswith: '/arp'\n        CommandLine|contains: '-a'\n    selection_2:\n        Image|endswith: '/ping'\n        CommandLine|contains:\n            - ' 10.' # 10.0.0.0/8\n            - ' 192.168.' # 192.168.0.0/16\n            - ' 172.16.' # 172.16.0.0/12\n            - ' 172.17.'\n            - ' 172.18.'\n            - ' 172.19.'\n            - ' 172.20.'\n            - ' 172.21.'\n            - ' 172.22.'\n            - ' 172.23.'\n            - ' 172.24.'\n            - ' 172.25.'\n            - ' 172.26.'\n            - ' 172.27.'\n            - ' 172.28.'\n            - ' 172.29.'\n            - ' 172.30.'\n            - ' 172.31.'\n            - ' 127.' # 127.0.0.0/8\n            - ' 169.254.' # 169.254.0.0/16\n    condition: 1 of selection*\nfalsepositives:\n    - Legitimate administration activities\nlevel: informational\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1018","id":"T1018","name":"Remote System Discovery","page":"techniques/enterprise/T1018/"}],"data_path":"data/detection-rules/10227522-8429-47e6-a301-f2b2d014e7ad.json","kind":"sigma"}