huntrule

macOS Security Software Discovery via grep of Known Security Software Names

Flags /usr/bin/grep on macOS when command lines include identifiers associated with security tools and agents.

FreeReviewedSigma · Medium · v2
Product
macos
Category
process_creation
Author
Daniil Yugoslavskiy, oscd.community (SigmaHQ), DRL 1.1
Published
2020-10-19
Updated
2026-07-31
AnalysisDetection
title: macOS Security Software Discovery via grep of Known Security Software Names
id: fcf6218a-f915-477c-b256-f6c332aff657
status: test
description: This rule flags process executions of /usr/bin/grep where the command line contains strings associated with common security and endpoint software (e.g., Nessus, Santa, Carbon Black, CrowdStrike Falcon, osqueryd, and related agents/utilities). Attackers may use simple text-search tooling to quickly identify installed security products before staging further actions. It relies on process creation telemetry on macOS, including the process image path and full command line.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518.001/T1518.001.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_security_software_discovery.yml
author: Daniil Yugoslavskiy, oscd.community, Huntrule Team
date: 2020-10-19
modified: 2022-11-27
tags:
  - attack.discovery
  - attack.t1518.001
logsource:
  category: process_creation
  product: macos
detection:
  image:
    Image: /usr/bin/grep
  selection_cli_1:
    CommandLine|contains:
      - nessusd
      - santad
      - CbDefense
      - falcond
      - td-agent
      - packetbeat
      - filebeat
      - auditbeat
      - osqueryd
      - BlockBlock
      - LuLu
  selection_cli_2:
    CommandLine|contains|all:
      - Little
      - Snitch
  condition: image and 1 of selection_cli_*
falsepositives:
  - Legitimate activities
level: medium
license: DRL-1.1
related:
  - id: 0ed75b9c-c73b-424d-9e7d-496cd565fbe0
    type: derived