Detectionmediumtest

Disable Security Tools

Detects disabling security tools

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Daniil Yugoslavskiy, oscd.communityCreated Mon Oct 19Updated Sat Nov 27ff39f1a6-84ac-476f-a1af-37fcdf53d7c0macos

Log Source

macOSProcess Creation

ProductmacOS← raw: macos

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    launchctl_unload:
        Image: '/bin/launchctl'
        CommandLine|contains: 'unload'
    security_plists:
        CommandLine|contains:
            - 'com.objective-see.lulu.plist'                     # Objective-See firewall management utility
            - 'com.objective-see.blockblock.plist'               # Objective-See persistence locations watcher/blocker
            - 'com.google.santad.plist'                          # google santa
            - 'com.carbonblack.defense.daemon.plist'             # carbon black
            - 'com.carbonblack.daemon.plist'                     # carbon black
            - 'at.obdev.littlesnitchd.plist'                     # Objective Development Software firewall management utility
            - 'com.tenablesecurity.nessusagent.plist'            # Tenable Nessus
            - 'com.opendns.osx.RoamingClientConfigUpdater.plist' # OpenDNS Umbrella
            - 'com.crowdstrike.falcond.plist'                    # Crowdstrike Falcon
            - 'com.crowdstrike.userdaemon.plist'                 # Crowdstrike Falcon
            - 'osquery'                                          # facebook osquery
            - 'filebeat'                                         # elastic log file shipper
            - 'auditbeat'                                        # elastic auditing agent/log shipper
            - 'packetbeat'                                       # elastic network logger/shipper
            - 'td-agent'                                         # fluentd log shipper
    disable_gatekeeper:
        Image: '/usr/sbin/spctl'
        CommandLine|contains: 'disable'
    condition: (launchctl_unload and security_plists) or disable_gatekeeper