Merge pull request #1248 from oscd-initiative/oscd_art_macos_task_28_T1083

[OSCD] ART sync, test T1083: File and Directory Discovery (macOS)

rules/linux/macos_file_and_directory_discovery.yml

@@ -0,0 +1,31 @@
+title: File and Directory Discovery
+id: 089dbdf6-b960-4bcc-90e3-ffc3480c20f6
+status: experimental
+description: Detects usage of system utilities to discover files and directories
+author: Daniil Yugoslavskiy, oscd.community
+date: 2020/10/19
+references:
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1083/T1083.md
+logsource:
+  category: process_creation
+  product: macos
+detection:
+  file_with_asterisk:
+    ProcessName: '/usr/bin/file'
+    CommandLine|re: '(.){200,}' # execution of the 'file */* *>> /tmp/output.txt' will produce huge commandline
+  recursive_ls:
+    ProcessName: '/bin/ls'
+    CommandLine|contains: '-R'
+  find_execution:
+    ProcessName: '/usr/bin/find'
+  mdfind_execution:
+    ProcessName: '/usr/bin/mdfind'
+  tree_execution|endswith: 
+    ProcessName: '/tree'
+  condition: 1 of them
+falsepositives:
+  - Legitimate activities
+level: low
+tags:
+  - attack.discovery
+  - attack.t1083