{"id":"ff39f1a6-84ac-476f-a1af-37fcdf53d7c0","title":"Disable Security Tools","description":"Detects disabling security tools","author":"Daniil Yugoslavskiy, oscd.community","status":"test","level":"medium","date":"2020-10-19","modified":"2021-11-27","tags":["attack.defense-impairment","attack.t1685"],"technique_ids":["T1685"],"logsource":{"category":"process_creation","product":"macos"},"falsepositives":["Legitimate activities"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md"],"source_path":"rules/macos/process_creation/proc_creation_macos_disable_security_tools.yml","source_sha256":"a1e95ba10019a8b8c75f51d265b0522c93c715ffa03cb57a3aa87c99f8ddc757","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_disable_security_tools.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Disable Security Tools\nid: ff39f1a6-84ac-476f-a1af-37fcdf53d7c0\nstatus: test\ndescription: Detects disabling security tools\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md\nauthor: Daniil Yugoslavskiy, oscd.community\ndate: 2020-10-19\nmodified: 2021-11-27\ntags:\n    - attack.defense-impairment\n    - attack.t1685\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    launchctl_unload:\n        Image: '/bin/launchctl'\n        CommandLine|contains: 'unload'\n    security_plists:\n        CommandLine|contains:\n            - 'com.objective-see.lulu.plist'                     # Objective-See firewall management utility\n            - 'com.objective-see.blockblock.plist'               # Objective-See persistence locations watcher/blocker\n            - 'com.google.santad.plist'                          # google santa\n            - 'com.carbonblack.defense.daemon.plist'             # carbon black\n            - 'com.carbonblack.daemon.plist'                     # carbon black\n            - 'at.obdev.littlesnitchd.plist'                     # Objective Development Software firewall management utility\n            - 'com.tenablesecurity.nessusagent.plist'            # Tenable Nessus\n            - 'com.opendns.osx.RoamingClientConfigUpdater.plist' # OpenDNS Umbrella\n            - 'com.crowdstrike.falcond.plist'                    # Crowdstrike Falcon\n            - 'com.crowdstrike.userdaemon.plist'                 # Crowdstrike Falcon\n            - 'osquery'                                          # facebook osquery\n            - 'filebeat'                                         # elastic log file shipper\n            - 'auditbeat'                                        # elastic auditing agent/log shipper\n            - 'packetbeat'                                       # elastic network logger/shipper\n            - 'td-agent'                                         # fluentd log shipper\n    disable_gatekeeper:\n        Image: '/usr/sbin/spctl'\n        CommandLine|contains: 'disable'\n    condition: (launchctl_unload and security_plists) or disable_gatekeeper\nfalsepositives:\n    - Legitimate activities\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","page":"techniques/enterprise/T1685/"}],"data_path":"data/detection-rules/ff39f1a6-84ac-476f-a1af-37fcdf53d7c0.json","kind":"sigma"}