macOS firmwarepasswd Password Manipulation via setpasswd/full/delete/check

title: macOS firmwarepasswd Password Manipulation via setpasswd/full/delete/check
id: 02a9e3ae-a23a-4685-acba-ffe2999d945c
status: test
description: "This rule flags process executions of /usr/sbin/firmwarepasswd where the command line contains one or more password-management actions: setpasswd, full, delete, or check. Attackers may use firmware password features to change access controls at the boot level or verify firmware password configuration, making this activity relevant to impact and persistence risk. The detection relies on macOS process creation telemetry, specifically the executed image path and matching substrings within the command line."
references:
  - https://github.com/usnistgov/macos_security/blob/932a51f3e819dd3e02ebfcf3ef433cfffafbe28b/rules/os/os_firmware_password_require.yaml
  - https://www.manpagez.com/man/8/firmwarepasswd/
  - https://support.apple.com/guide/security/firmware-password-protection-sec28382c9ca/web
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_susp_macos_firmware_activity.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-09-30
modified: 2022-10-09
tags:
  - attack.impact
logsource:
  category: process_creation
  product: macos
detection:
  selection1:
    Image: /usr/sbin/firmwarepasswd
    CommandLine|contains:
      - setpasswd
      - full
      - delete
      - check
  condition: selection1
falsepositives:
  - Legitimate administration activities
level: medium
license: DRL-1.1
related:
  - id: 7ed2c9f7-c59d-4c82-a7e2-f859aa676099
    type: derived