macOS Emond Launch Daemon persistence via new rule plist files

title: macOS Emond Launch Daemon persistence via new rule plist files
id: 118e64fc-c78b-4a86-939c-78dc33e82807
status: test
description: This rule flags file events where a .plist is created or modified within the Emond rules directory (/etc/emond.d/rules/), or where files appear under the emond client database path (/private/var/db/emondClients/). Attackers may use Emond to persist code execution and potentially achieve elevated privileges by loading new or altered rule definitions. The detection relies on macOS file event telemetry that captures target filenames for these specific directories.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.014/T1546.014.md
  - https://posts.specterops.io/leveraging-emond-on-macos-for-persistence-a040a2785124
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/file_event/file_event_macos_emond_launch_daemon.yml
author: Alejandro Ortuno, oscd.community, Huntrule Team
date: 2020-10-23
modified: 2021-11-27
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1546.014
logsource:
  category: file_event
  product: macos
detection:
  selection_1:
    TargetFilename|contains: /etc/emond.d/rules/
    TargetFilename|endswith: .plist
  selection_2:
    TargetFilename|contains: /private/var/db/emondClients/
  condition: 1 of selection_*
falsepositives:
  - Legitimate administration activities
level: medium
license: DRL-1.1
related:
  - id: 23c43900-e732-45a4-8354-63e4a6c187ce
    type: derived