MacOS Network Service Scanning
A Sigma rule for process creation on macOS, by Alejandro Ortuno, oscd.community.
low 1 ATT&CK technique 4 programs it names 8 everyday examples trip it
What it looks for
detection:
filter_main_nc_listen:
CommandLine|re: '\s(?:--listen\b|-[46DdknrtuUvz]{0,10}l[46DdknrtuUvz]{0,10})'
selection_netcat:
Image|endswith:
- '/nc'
- '/netcat'
selection_other:
Image|endswith:
- '/nmap'
- '/telnet'
condition: (selection_netcat and not 1 of filter_main_nc_*) or selection_other
The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by Alejandro Ortuno, oscd.community, under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.
Command lines that trip it
Connect to a target listener on the specified port and receive a file from it on the page for nc
nc host port >received_filenameIdentifyScan the open TCP ports of a specified host on the page for nc
nc -v -z -w timeout_in_seconds host start_port-end_portIdentifyScan the top 1000 ports of a remote host with various verbosity levels on the page for nmap
nmap -v1 ip_or_hostnameIdentifyRun a ping sweep over an entire subnet or individual hosts very aggressively on the page for nmap
nmap -T5 -sn 192.168.0.0/24IdentifyEnable OS detection, version detection, script scanning, and traceroute of hosts from a file on the page for nmap
sudo nmap -A -iL path/to/file.txtIdentifyReconnect Arthas (default port used by Arthas is 3658) on the page for arthas
telnet localhost port_numberIdentifyThe commands documented for busybox, nc, nmap, telnet trip it too: each is on its program’s page, read by CmdID.