macOS: Detect Suspicious Child Processes Spawned by jamf

Alerts when jamf on macOS spawns bash or sh, which may indicate misuse for command execution.

FreeUnreviewedSigmamediumv1

macos-detect-suspicious-child-processes-spawned-by-jamf-2316929c

title: "macOS: Detect Suspicious Child Processes Spawned by jamf"
id: 966d9c48-f97c-461c-a70f-4fdef0415552
status: test
description: This rule flags macOS process creations where the parent process image ends with /jamf and the spawned child process image ends with /bash or /sh. Attackers abusing Jamf workflows may use it to launch shell tooling, enabling follow-on command execution. It relies on process creation telemetry that includes parent and child process image paths.
references:
  - https://github.com/MythicAgents/typhon/
  - https://www.zoocoup.org/casper/jamf_cheatsheet.pdf
  - https://docs.jamf.com/10.30.0/jamf-pro/administrator-guide/Components_Installed_on_Managed_Computers.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_jamf_susp_child.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-08-22
tags:
  - attack.execution
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    ParentImage|endswith: /jamf
    Image|endswith:
      - /bash
      - /sh
  condition: selection
falsepositives:
  - Legitimate execution of custom scripts or commands by Jamf administrators. Apply additional filters accordingly
level: medium
license: DRL-1.1
related:
  - id: 2316929c-01aa-438c-970f-099145ab1ee6
    type: derived

What it detects

This rule flags macOS process creations where the parent process image ends with /jamf and the spawned child process image ends with /bash or /sh. Attackers abusing Jamf workflows may use it to launch shell tooling, enabling follow-on command execution. It relies on process creation telemetry that includes parent and child process image paths.

Known false positives

Legitimate execution of custom scripts or commands by Jamf administrators. Apply additional filters accordingly

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.