System Network Discovery - macOS

Title: System Network Discovery - macOS
Status: test
Description:Detects enumeration of local network configuration
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1016/T1016.md
Author: remotephone, oscd.community
Date: 2020-10-06
modified:2024-08-29
Tags:

• -'attack.discovery'
• -'attack.t1016'

Logsource:

• product: macos
• category: process_creation

Detection:
  selection_1:
    Image|endswith:
      -'/arp'
      -'/ifconfig'
      -'/netstat'
      -'/networksetup'
      -'/socketfilterfw'

  selection_2:
    Image: '/usr/bin/defaults'
    CommandLine|contains|all:
      -'/Library/Preferences/com.apple.alf'
      -'read'

  filter_main_wifivelocityd:
    ParentImage|endswith: '/wifivelocityd'
  condition:1 of selection_* and not 1 of filter_main_*
Falsepositives:
  -Legitimate administration activities
Level: informational