Disable Security Tools

Title: Disable Security Tools
Status: test
Description:Detects disabling security tools
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
Author: Daniil Yugoslavskiy, oscd.community
Date: 2020-10-19
modified:2021-11-27
Tags:

• -'attack.defense-impairment'
• -'attack.t1685'

Logsource:

• category: process_creation
• product: macos

Detection:
  launchctl_unload:
    Image: '/bin/launchctl'
    CommandLine|contains: 'unload'
  security_plists:
    CommandLine|contains:
      -'com.objective-see.lulu.plist'
      -'com.objective-see.blockblock.plist'
      -'com.google.santad.plist'
      -'com.carbonblack.defense.daemon.plist'
      -'com.carbonblack.daemon.plist'
      -'at.obdev.littlesnitchd.plist'
      -'com.tenablesecurity.nessusagent.plist'
      -'com.opendns.osx.RoamingClientConfigUpdater.plist'
      -'com.crowdstrike.falcond.plist'
      -'com.crowdstrike.userdaemon.plist'
      -'osquery'
      -'filebeat'
      -'auditbeat'
      -'packetbeat'
      -'td-agent'

  disable_gatekeeper:
    Image: '/usr/sbin/spctl'
    CommandLine|contains: 'disable'
  condition:(launchctl_unload and security_plists) or disable_gatekeeper
Falsepositives:
  -Legitimate activities
Level: medium