Ioc

[itonyr]

Proposed Change

Add a data source that will generate MacOS Unified Logging commands that demonstrate Indicators of Compromise. This includes:

• IP's that are listed on the Abusedb
• Behaviors that demonstrate the MITRE ATT&CK Technique with ID T1649 on MacOS. Specifically, it demonstrates the behavior outlined in detection strategy DET0349.

AN0992
Detect suspicious file creations and process executions triggered by browser activity (e.g., injected payloads written to %AppData% or Temp directories, then executed). 

Correlate network anomalies with subsequent local process creation or script execution. 

AN0993 
Detect curl/wget commands saving executable/script payloads to /tmp or /var/tmp followed by execution. Monitor packet captures or IDS/IPS alerts for injected responses or mismatched content types. 

AN0994 
Monitor unified logs for processes spawned from Safari or other browsers that immediately load scripts or executables. Detect file drops in ~/Library/Caches or ~/Downloads that execute shortly after being written

More IOC's to be added for UL.

Checklist

• Changes are tested
• CI has passed

[Dylan-M]

Another thing I noticed is that sometimes you have extra newlines. I don't know how that will affect the generator. I designed it with the sample files all not having them.

[itonyr]

It handled them well when I ran it, this was to let me separate between IOC's and fake log data visually. I can remove it but didn't run into issues AFAIK. Testing again now.

[Dylan-M]

I think you just need to address the PR feedback.

[itonyr]

Should be all set but do we need a trailing new line? I see a lot of the others have it

[Dylan-M]

I don't think it matters, any more than your extra newlines mattered (I wasn't sure if they did or not, you could keep them so long as it works)

It was the other PR feedback I meant needed addressed.

[jsirianni]

Do we still need this?

[Dylan-M]

Do we still need this?

You may want to ping Tony on Slack