macOS Jamf MDM Suspicious Child Process Execution
Alerts when jamf on macOS spawns bash or sh, which may indicate misuse for command execution.
FreeReviewedSigma · Medium · v2
- Product
- macos
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-08-22
- Updated
- 2026-07-31
What it detects
This rule flags macOS process creation events where the parent process path ends with '/jamf' and the child process path ends with common shell binaries such as '/bash' or '/sh'. Such behavior matters because it can indicate misuse of Jamf to spawn command execution under an expected management component. The detection relies on process creation telemetry, specifically parent and child process image path endings.
Reporting behind it
- github.comhttps://github.com/MythicAgents/typhon/
- zoocoup.orghttps://www.zoocoup.org/casper/jamf_cheatsheet.pdf
- docs.jamf.comhttps://docs.jamf.com/10.30.0/jamf-pro/administrator-guide/Components_Installed_on_Managed_Computers.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_jamf_susp_child.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
macos-detect-suspicious-child-processes-spawned-by-jamf-2316929c
title: macOS Jamf MDM Suspicious Child Process Execution
id: 966d9c48-f97c-461c-a70f-4fdef0415552
status: test
description: This rule flags macOS process creation events where the parent process path ends with '/jamf' and the child process path ends with common shell binaries such as '/bash' or '/sh'. Such behavior matters because it can indicate misuse of Jamf to spawn command execution under an expected management component. The detection relies on process creation telemetry, specifically parent and child process image path endings.
references:
- https://github.com/MythicAgents/typhon/
- https://www.zoocoup.org/casper/jamf_cheatsheet.pdf
- https://docs.jamf.com/10.30.0/jamf-pro/administrator-guide/Components_Installed_on_Managed_Computers.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_jamf_susp_child.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-08-22
tags:
- attack.execution
logsource:
category: process_creation
product: macos
detection:
selection:
ParentImage|endswith: /jamf
Image|endswith:
- /bash
- /sh
condition: selection
falsepositives:
- Legitimate execution of custom scripts or commands by Jamf administrators. Apply additional filters accordingly
level: medium
license: DRL-1.1
related:
- id: 2316929c-01aa-438c-970f-099145ab1ee6
type: derived