Potential Persistence Via PlistBuddy

Title: Potential Persistence Via PlistBuddy
Status: test
Description:Detects potential persistence activity using LaunchAgents or LaunchDaemons via the PlistBuddy utility
References:
  -https://redcanary.com/blog/clipping-silver-sparrows-wings/
  -https://www.manpagez.com/man/8/PlistBuddy/
Author: Sohan G (D4rkCiph3r)
Date: 2023-02-18
modified:None
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.t1543.001'
• -'attack.t1543.004'

Logsource:

• category: process_creation
• product: macos

Detection:
  selection:
    Image|endswith: '/PlistBuddy'
    CommandLine|contains|all:
      -'RunAtLoad'
      -'true'

    CommandLine|contains:
      -'LaunchAgents'
      -'LaunchDaemons'

  condition:selection
Falsepositives:
  -Unknown
Level: high