macOS JAMF CLI Command Execution for Account, MDM, and Framework Changes

Flags macOS executions of the JAMF CLI with command-line actions tied to account, MDM, and framework changes.

FreeUnreviewedSigmalowv1

macos-jamf-cli-command-execution-for-account-mdm-and-framework-changes-be2e3a5c

title: macOS JAMF CLI Command Execution for Account, MDM, and Framework Changes
id: c2f264d3-f927-44ef-a7eb-d3cf1cbc4a05
status: test
description: This rule identifies execution of the macOS "jamf" binary when its command line contains actions associated with user/account management, MDM profile removal, and framework changes. Attackers can abuse the JAMF CLI to alter device state, disrupt security controls, or reset and reconfigure settings on managed systems. The detection relies on macOS process creation telemetry, matching the process image path ending in /jamf and specific command-line keywords.
references:
  - https://github.com/MythicAgents/typhon/
  - https://www.zoocoup.org/casper/jamf_cheatsheet.pdf
  - https://docs.jamf.com/10.30.0/jamf-pro/administrator-guide/Components_Installed_on_Managed_Computers.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_jamf_usage.yml
author: Jay Pandit, Huntrule Team
date: 2023-08-22
tags:
  - attack.execution
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith: /jamf
    CommandLine|contains:
      - createAccount
      - manage
      - removeFramework
      - removeMdmProfile
      - resetPassword
      - setComputerName
  condition: selection
falsepositives:
  - Legitimate use of the JAMF CLI tool by IT support and administrators
level: low
license: DRL-1.1
related:
  - id: be2e3a5c-9cc7-4d02-842a-68e9cb26ec49
    type: derived

What it detects

This rule identifies execution of the macOS "jamf" binary when its command line contains actions associated with user/account management, MDM profile removal, and framework changes. Attackers can abuse the JAMF CLI to alter device state, disrupt security controls, or reset and reconfigure settings on managed systems. The detection relies on macOS process creation telemetry, matching the process image path ending in /jamf and specific command-line keywords.

Known false positives

Legitimate use of the JAMF CLI tool by IT support and administrators

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.