valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 01:45:21 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

update syntax a bit to re-run the test

Browse Source
This commit is contained in:
yugoslavskiy 2020-10-20 17:31:00 +02:00 committed by GitHub
parent bf8426d71b
commit 585770faa3
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 2 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
rules/linux/macos_startup_items.yml
View File

@ -11,11 +11,9 @@ logsource:
product: macos product: macos
detection: detection:
selection_1: selection_1:
TargetFilename|contains: TargetFilename|contains: '/Library/StartupItems/'
- '/Library/StartupItems/'
selection_2: selection_2:
TargetFilename|endswith: TargetFilename|endswith: '.plist'
- '.plist'
condition: selection_1 and selection_2 condition: selection_1 and selection_2
falsepositives: falsepositives:
- Legitimate administration activities - Legitimate administration activities
@ -24,4 +22,3 @@ tags:
- attack.persistence - attack.persistence
- attack.privilege_escalation - attack.privilege_escalation
- attack.t1037.005 - attack.t1037.005