Hi,
It looks like there is an error with the Data Source annotation on the MacOS - Re-opened Applications detection.
The detection is clearly targeted at macOS and finds processes associated with com.apple.loginwindow in the Endpoint.Processes data model. Its current Data Source annotation is as follows:
Name: Sysmon EventID 1
Platform: Windows
Sourcetype: XmlWinEventLog
Source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
Since Sysmon EventID 1 is a Windows process creation data source, the above is a clear metadata/annotation error in my opinion.
Moreover, the ColdRoot MacOS RAT Analytic Story that this detection belongs to says that it uses OSquery features in its searches and Osquery Results is indeed one of the data sources used by this story.
The Data Source annotation in MacOS - Re-opened Applications must be consistent with the actual data source that is leveraged for the macOS detection.
According to the associated Analytic Story as well as the actual macOS detections in Splunk Security Content, the expected Data Source should be:
Name: Osquery Results
Platform: Other
Sourcetype: osquery:results
Source: osquery
It seems that the problem only affects the Data Source metadata and not the detection SPL.
Currently, the detection is marked as Experimental, while its detection testing is categorized as Not Applicable / Failing; therefore, this report pertains to the incorrect Data Source metadata and not the detection logic itself.
Thank you for your time and consideration.
Best regards
App Version:
Hi,
It looks like there is an error with the Data Source annotation on the MacOS - Re-opened Applications detection.
The detection is clearly targeted at macOS and finds processes associated with com.apple.loginwindow in the Endpoint.Processes data model. Its current Data Source annotation is as follows:
Name: Sysmon EventID 1
Platform: Windows
Sourcetype: XmlWinEventLog
Source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
Since Sysmon EventID 1 is a Windows process creation data source, the above is a clear metadata/annotation error in my opinion.
Moreover, the ColdRoot MacOS RAT Analytic Story that this detection belongs to says that it uses OSquery features in its searches and Osquery Results is indeed one of the data sources used by this story.
The Data Source annotation in MacOS - Re-opened Applications must be consistent with the actual data source that is leveraged for the macOS detection.
According to the associated Analytic Story as well as the actual macOS detections in Splunk Security Content, the expected Data Source should be:
Name: Osquery Results
Platform: Other
Sourcetype: osquery:results
Source: osquery
It seems that the problem only affects the Data Source metadata and not the detection SPL.
Currently, the detection is marked as Experimental, while its detection testing is categorized as Not Applicable / Failing; therefore, this report pertains to the incorrect Data Source metadata and not the detection logic itself.
Thank you for your time and consideration.
Best regards
App Version: