Macos Remote System Discovery

Title: Macos Remote System Discovery
Status: test
Description:Detects the enumeration of other remote systems.
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md
Author: Alejandro Ortuno, oscd.community
Date: 2020-10-22
modified:2021-11-27
Tags:

• -'attack.discovery'
• -'attack.t1018'

Logsource:

• category: process_creation
• product: macos

Detection:
  selection_1:
    Image|endswith: '/arp'
    CommandLine|contains: '-a'
  selection_2:
    Image|endswith: '/ping'
    CommandLine|contains:
      -' 10.'
      -' 192.168.'
      -' 172.16.'
      -' 172.17.'
      -' 172.18.'
      -' 172.19.'
      -' 172.20.'
      -' 172.21.'
      -' 172.22.'
      -' 172.23.'
      -' 172.24.'
      -' 172.25.'
      -' 172.26.'
      -' 172.27.'
      -' 172.28.'
      -' 172.29.'
      -' 172.30.'
      -' 172.31.'
      -' 127.'
      -' 169.254.'

  condition:1 of selection*
Falsepositives:
  -Legitimate administration activities
Level: informational