This documentation contains work-in-progress information for future Elastic Stack and Cloud releases. Use the version selector to view supported release docs. It also contains some Elastic Cloud serverless information. Check out our serverless docs for more details.
« Persistence via KDE AutoStart Script or Desktop File Modification Persistence via Microsoft Office AddIns »
Elastic Docs ›Elastic Security Solution [master] ›Detections and alerts ›Prebuilt rule reference

Persistence via Login or Logout Hook

edit

Persistence via Login or Logout Hook

edit

Identifies use of the Defaults command to install a login or logoff hook in MacOS. An adversary may abuse this capability to establish persistence in an environment by inserting code to be executed at login or logout.

Rule type: eql

Rule indices:

  • auditbeat-*
  • logs-endpoint.events.*

Severity: medium

Risk score: 47

Runs every: 5 minutes

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Elastic
  • Host
  • macOS
  • Threat Detection
  • Persistence

Version: 100 (version history)

Added (Elastic Stack release): 7.11.0

Last modified (Elastic Stack release): 8.5.0

Rule authors: Elastic

Rule license: Elastic License v2

Investigation guide

edit











Rule query
edit








process where event.type == "start" and process.name == "defaults"
and process.args == "write" and process.args in ("LoginHook",
"LogoutHook") and not process.args : (
"Support/JAMF/ManagementFrameworkScripts/logouthook.sh",
"Support/JAMF/ManagementFrameworkScripts/loginhook.sh",
"/Library/Application
Support/JAMF/ManagementFrameworkScripts/logouthook.sh",
"/Library/Application
Support/JAMF/ManagementFrameworkScripts/loginhook.sh" )











Threat mapping
edit




Framework: MITRE ATT&CKTM














Rule version history
edit










Version 100 (8.5.0 release)








    

  • 
Formatting only

    • 









Version 7 (8.4.0 release)








    

  • 
Formatting only

    • 









Version 5 (8.2.0 release)








    

  • 
Formatting only

    • 









Version 4 (7.13.0 release)








    

  • 

    Updated query, changed from:
    

    

    

    process where event.type in ("start", "process_started") and
process.name == "defaults" and process.args == "write" and
process.args in ("LoginHook", "LogoutHook")
    

    

    • 









Version 3 (7.12.0 release)








    

  • 
Formatting only

    • 









Version 2 (7.11.2 release)








    

  • 
Formatting only

    • 




















« Persistence via KDE AutoStart Script or Desktop File Modification


Persistence via Microsoft Office AddIns »