macOS File and Directory Discovery via System Utilities

title: macOS File and Directory Discovery via System Utilities
id: 3fb7bd61-eac7-4bce-a5f4-3c38fae1027d
status: test
description: This rule flags macOS process executions of common system utilities used to enumerate files and directories, including file, ls (with recursive -R), find, mdfind, and tree. Attackers commonly perform discovery to locate files, paths, and potentially sensitive content before further actions. It relies on process creation telemetry capturing the executable path (Image) and command-line patterns that indicate enumeration behavior.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1083/T1083.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_file_and_directory_discovery.yml
author: Daniil Yugoslavskiy, oscd.community, Huntrule Team
date: 2020-10-19
modified: 2022-11-25
tags:
  - attack.discovery
  - attack.t1083
logsource:
  category: process_creation
  product: macos
detection:
  select_file_with_asterisk:
    Image: /usr/bin/file
    CommandLine|re: (.){200,}
  select_recursive_ls:
    Image: /bin/ls
    CommandLine|contains: -R
  select_find_execution:
    Image: /usr/bin/find
  select_mdfind_execution:
    Image: /usr/bin/mdfind
  select_tree_execution|endswith:
    Image: /tree
  condition: 1 of select*
falsepositives:
  - Legitimate activities
level: informational
license: DRL-1.1
related:
  - id: 089dbdf6-b960-4bcc-90e3-ffc3480c20f6
    type: derived