macOS Security Tool Discovery via grep of Known Agent and Firewall Strings

Flags /usr/bin/grep on macOS when command lines include identifiers associated with security tools and agents.

FreeUnreviewedSigmamediumv1

macos-security-tool-discovery-via-grep-of-known-agent-and-firewall-strings-0ed75b9c

title: macOS Security Tool Discovery via grep of Known Agent and Firewall Strings
id: fcf6218a-f915-477c-b256-f6c332aff657
status: test
description: This rule matches process creation events where /usr/bin/grep is executed with command-line arguments containing strings tied to security tools, agents, and related components. Such discovery activity can help an attacker identify installed security software before attempting evasion or targeting specific tooling. Telemetry relies on macOS process creation data, including the executable path and full command line.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518.001/T1518.001.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_security_software_discovery.yml
author: Daniil Yugoslavskiy, oscd.community, Huntrule Team
date: 2020-10-19
modified: 2022-11-27
tags:
  - attack.discovery
  - attack.t1518.001
logsource:
  category: process_creation
  product: macos
detection:
  image:
    Image: /usr/bin/grep
  selection_cli_1:
    CommandLine|contains:
      - nessusd
      - santad
      - CbDefense
      - falcond
      - td-agent
      - packetbeat
      - filebeat
      - auditbeat
      - osqueryd
      - BlockBlock
      - LuLu
  selection_cli_2:
    CommandLine|contains|all:
      - Little
      - Snitch
  condition: image and 1 of selection_cli_*
falsepositives:
  - Legitimate activities
level: medium
license: DRL-1.1
related:
  - id: 0ed75b9c-c73b-424d-9e7d-496cd565fbe0
    type: derived

What it detects

This rule matches process creation events where /usr/bin/grep is executed with command-line arguments containing strings tied to security tools, agents, and related components. Such discovery activity can help an attacker identify installed security software before attempting evasion or targeting specific tooling. Telemetry relies on macOS process creation data, including the executable path and full command line.

Known false positives

Legitimate activities

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.