JAMF MDM Possible Suspicious Child Process (via process_creation)

title: JAMF MDM Possible Suspicious Child Process (via process_creation)
id: 8350e3cf-a93d-5cc7-888a-2f3727d11fba
status: stable
description: This rule detects potential anomalous child processes of "jamf". Could be a sign of potential misuse of Jamf as a C2 server as seen by Typhon MythicAgent.
references:
    - https://github.com/MythicAgents/typhon/
    - https://www.zoocoup.org/casper/jamf_cheatsheet.pdf
    - https://docs.jamf.com/10.30.0/jamf-pro/administrator-guide/Components_Installed_on_Managed_Computers.html
author: Huntrule Team
date: 2026-01-13
tags:
    - attack.execution
    - attack.lateral-movement
    - attack.t1072
logsource:
    category: process_creation
    product: macos
detection:
    selection:
        ParentImage|endswith: '/jamf'
        Image|endswith:
            - '/bash'
            - '/sh'
    condition: selection
falsepositives:
    - Unknown
level: medium