SigmaHQ/rules/linux/macos_network_service_scanning.yml

title: MacOS Network Service Scanning
id: 84bae5d4-b518-4ae0-b331-6d4afd34d00f
status: experimental
description: Detects enumeration of local or remote network services.
author: Alejandro Ortuno, oscd.community
date: 2020/10/21
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1046/T1046.md
logsource:
  category: process_creation
  product: macos
detection:
  selection_1:
    ProcessName|endswith:
      - '/nc'
      - '/netcat'
  selection_2:
    ProcessName|endswith:
      - '/nmap'
      - '/telnet'
  filter:
    CommandLine|contains: 'l'
  condition: (selection_1 and not filter) or selection_2 
falsepositives:
  - Legitimate administration activities
level: low
tags:
  - attack.discovery
  - attack.t1046