CmdID

CmdID / Rules / macOS

System Network Connections Discovery - MacOs

A Sigma rule for process creation on macOS, by Daniil Yugoslavskiy, oscd.community.

informational 1 ATT&CK technique 5 programs it names 32 everyday examples trip it

What it looks for

its detection, as SigmaHQ writes it
detection:
  selection:
    Image|endswith:
      - '/who'
      - '/w'
      - '/last'
      - '/lsof'
      - '/netstat'
  condition: selection

The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by Daniil Yugoslavskiy, oscd.community, under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.

Command lines that trip it

everyday examples from tldr-pages, CC BY 4.0, each read by CmdID

View last login information (e.g., username, terminal, boot time, kernel) of all users as read from /var/log/wtmp on the page for last

List login information of a specific user on the page for last

last usernameIdentify

Specify how many of the last logins to show on the page for last

last --limit login_countIdentify

Find the processes that have a given file open on the page for lsof

lsof path/to/fileIdentify

Find the process that opened a local internet port on the page for lsof

lsof -i :portIdentify

Only output the process ID (PID) on the page for lsof

lsof -t path/to/fileIdentify

List files opened by the given user on the page for lsof

lsof -u usernameIdentify

List files opened by the given command or process on the page for lsof

lsof -c process_or_command_nameIdentify

List files opened by a specific process, given its PID on the page for lsof

lsof -p process_idIdentify

List open files in a directory on the page for lsof

lsof +D path/to/directoryIdentify

Find the process that is listening on a local IPv6 TCP port and don't convert network or port numbers on the page for lsof

lsof -i6TCP:port -sTCP:LISTEN -n -PIdentify

List all ports on the page for netstat

netstat --allIdentify

And 20 more examples on CmdID’s program pages.

The commands documented for last, lastb trip it too: each is on its program’s page, read by CmdID.

Programs and files it names

their pages here
lastlsofnetstatwwho

ATT&CK

the techniques it is tagged with
T1049System Network Connections Discovery

Other rules for T1049 System Network Connections Discovery

System Network Connections Discovery - Linux · System Network Connections Discovery Via Net.EXE