{"id":"65d506d3-fcfe-4071-b4b2-bcefe721bbbb","title":"Potential Persistence Via PlistBuddy","description":"Detects potential persistence activity using LaunchAgents or LaunchDaemons via the PlistBuddy utility","author":"Sohan G (D4rkCiph3r)","status":"test","level":"high","date":"2023-02-18","modified":"","tags":["attack.privilege-escalation","attack.persistence","attack.t1543.001","attack.t1543.004"],"technique_ids":["T1543.001","T1543.004"],"logsource":{"category":"process_creation","product":"macos"},"falsepositives":["Unknown"],"references":["https://redcanary.com/blog/clipping-silver-sparrows-wings/","https://www.manpagez.com/man/8/PlistBuddy/"],"source_path":"rules/macos/process_creation/proc_creation_macos_persistence_via_plistbuddy.yml","source_sha256":"cfe2a9226062ec326cc0b8587d94e9e61c5a7050ba71cd4e359d882c05438526","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_persistence_via_plistbuddy.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Persistence Via PlistBuddy\nid: 65d506d3-fcfe-4071-b4b2-bcefe721bbbb\nstatus: test\ndescription: Detects potential persistence activity using LaunchAgents or LaunchDaemons via the PlistBuddy utility\nreferences:\n    - https://redcanary.com/blog/clipping-silver-sparrows-wings/\n    - https://www.manpagez.com/man/8/PlistBuddy/\nauthor: Sohan G (D4rkCiph3r)\ndate: 2023-02-18\ntags:\n    - attack.privilege-escalation\n    - attack.persistence\n    - attack.t1543.001\n    - attack.t1543.004\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        Image|endswith: '/PlistBuddy'\n        CommandLine|contains|all:\n            - 'RunAtLoad'\n            - 'true'\n        CommandLine|contains:\n            - 'LaunchAgents'\n            - 'LaunchDaemons'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1543.001","id":"T1543.001","name":"Launch Agent","page":"techniques/enterprise/T1543.001/"},{"key":"enterprise/T1543.004","id":"T1543.004","name":"Launch Daemon","page":"techniques/enterprise/T1543.004/"}],"data_path":"data/detection-rules/65d506d3-fcfe-4071-b4b2-bcefe721bbbb.json","kind":"sigma"}