macOS File and Directory Discovery via System Utilities

title: macOS File and Directory Discovery via System Utilities
id: 3fb7bd61-eac7-4bce-a5f4-3c38fae1027d
status: test
description: This rule flags macOS process executions of common discovery utilities used to enumerate files and directories, including /usr/bin/file with long command lines, recursive listing with /bin/ls -R, and filesystem search tools such as /usr/bin/find and /usr/bin/mdfind. Attackers often use these commands to map targets before staging additional activity. It relies on process creation telemetry capturing the executed Image path and CommandLine content patterns (regular expression, substring, and suffix matches).
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1083/T1083.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_file_and_directory_discovery.yml
author: Daniil Yugoslavskiy, oscd.community, Huntrule Team
date: 2020-10-19
modified: 2022-11-25
tags:
  - attack.discovery
  - attack.t1083
logsource:
  category: process_creation
  product: macos
detection:
  select_file_with_asterisk:
    Image: /usr/bin/file
    CommandLine|re: (.){200,}
  select_recursive_ls:
    Image: /bin/ls
    CommandLine|contains: -R
  select_find_execution:
    Image: /usr/bin/find
  select_mdfind_execution:
    Image: /usr/bin/mdfind
  select_tree_execution|endswith:
    Image: /tree
  condition: 1 of select*
falsepositives:
  - Legitimate activities
level: informational
license: DRL-1.1
related:
  - id: 089dbdf6-b960-4bcc-90e3-ffc3480c20f6
    type: derived