Login Hook

// Detection for T1037.002 - macOS Login Hook via Syslog/CommonSecurityLog ingested into Sentinel
// Covers: defaults write to loginwindow plist, direct plist modification, and suspicious script execution at login
let LoginHookPaths = dynamic([
  "/Library/Preferences/com.apple.loginwindow.plist",
  "com.apple.loginwindow"
]);
let LoginHookKeys = dynamic([
  "LoginHook",
  "LogoutHook"
]);
// Detection 1: Process events showing 'defaults' command modifying loginwindow plist
let DefaultsModification = Syslog
| where TimeGenerated > ago(24h)
| where SyslogMessage has "defaults" and SyslogMessage has "com.apple.loginwindow"
| where SyslogMessage has_any ("LoginHook", "LogoutHook")
| extend CommandLine = extract(@"defaults\s+.+", 0, SyslogMessage)
| extend HookType = iff(SyslogMessage has "LoginHook", "LoginHook", "LogoutHook")
| extend ScriptPath = extract(@"(LoginHook|LogoutHook)\s+([/\w\-.]+)", 2, SyslogMessage)
| project TimeGenerated, Computer, SyslogMessage, CommandLine, HookType, ScriptPath,
          HostName, ProcessName
| extend DetectionType = "defaults_write_loginwindow";
// Detection 2: Direct file write to loginwindow plist
let PlistFileWrite = Syslog
| where TimeGenerated > ago(24h)
| where SyslogMessage has "/Library/Preferences/com.apple.loginwindow.plist"
| where SyslogMessage has_any ("write", "open", "create", "truncate", "rename")
| project TimeGenerated, Computer, SyslogMessage, HostName, ProcessName
| extend DetectionType = "plist_file_modification"
| extend HookType = "unknown"
| extend ScriptPath = ""
| extend CommandLine = SyslogMessage;
// Detection 3: CommonSecurityLog (CEF) from macOS endpoint agents
let CEFLoginHook = CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceEventClassID in ("process_create", "file_write", "file_create")
| where RequestURL has_any (LoginHookPaths) or Message has_any (LoginHookKeys)
| extend CommandLine = RequestURL
| extend HookType = iff(Message has "LoginHook", "LoginHook", iff(Message has "LogoutHook", "LogoutHook", "unknown"))
| extend ScriptPath = extract(@"(LoginHook|LogoutHook)[\s=]+([/\w\-.]+)", 2, Message)
| project TimeGenerated, Computer = DeviceName, SyslogMessage = Message, CommandLine,
          HookType, ScriptPath, HostName = DeviceName, ProcessName = SourceProcessName
| extend DetectionType = "cef_endpoint_agent";
// Union all detections
DefaultsModification
| union CEFLoginHook
| union PlistFileWrite
| sort by TimeGenerated desc

index=syslog OR index=mac_logs sourcetype="syslog" OR sourcetype="linux_secure" OR sourcetype="macos_secure"
| eval raw_lower = lower(_raw)
| where (match(raw_lower, "defaults") AND match(raw_lower, "com\.apple\.loginwindow"))
   OR match(raw_lower, "loginhook")
   OR match(raw_lower, "logouthook")
   OR (match(raw_lower, "loginwindow\.plist") AND match(raw_lower, "(write|create|open|truncate)"))
| eval HookType = case(
    match(raw_lower, "loginhook"), "LoginHook",
    match(raw_lower, "logouthook"), "LogoutHook",
    true(), "unknown"
  )
| eval DefaultsWrite = if(match(raw_lower, "defaults.*write.*loginwindow"), 1, 0)
| eval PlistDirectWrite = if(match(raw_lower, "loginwindow\.plist") AND match(raw_lower, "(write|create|truncate|rename)"), 1, 0)
| eval ScriptPath = coalesce(
    mvindex(split(rex(field=_raw, "(?i)(LoginHook|LogoutHook)\s+([/\w\-.]+)"), " "), 2),
    "unknown"
  )
| rex field=_raw "(?i)(?:defaults\s+write\s+[^\s]+\s+(?:Login|Logout)Hook\s+)(?<extracted_script>[/\w.\-]+)"
| eval SuspicionScore = DefaultsWrite + PlistDirectWrite
| where SuspicionScore > 0 OR HookType != "unknown"
| table _time, host, sourcetype, HookType, DefaultsWrite, PlistDirectWrite, extracted_script, SuspicionScore, _raw
| sort - _time

any where
  (
    event.category == "process" and
    event.type == "start" and
    process.name == "defaults" and
    process.args : "com.apple.loginwindow" and
    process.args : ("LoginHook", "LogoutHook")
  ) or
  (
    event.category == "file" and
    event.type in ("creation", "change") and
    file.path == "/Library/Preferences/com.apple.loginwindow.plist" and
    not process.name in ("mDNSResponder", "cfprefsd", "nsurlsessiond")
  )

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
  sourceip AS SourceIP,
  username AS Username,
  hostname AS Hostname,
  QIDNAME(qid) AS EventName,
  LOGSOURCETYPENAME(devicetype) AS LogSourceType,
  CATEGORYNAME(category) AS Category,
  CASE
    WHEN LOWER("UTF8(payload)") LIKE '%loginhook%' THEN 'LoginHook'
    WHEN LOWER("UTF8(payload)") LIKE '%logouthook%' THEN 'LogoutHook'
    ELSE 'unknown'
  END AS HookType,
  CASE
    WHEN LOWER("UTF8(payload)") LIKE '%defaults%write%loginwindow%' THEN 1
    ELSE 0
  END AS DefaultsWrite,
  CASE
    WHEN LOWER("UTF8(payload)") LIKE '%loginwindow.plist%'
     AND (LOWER("UTF8(payload)") LIKE '%write%'
       OR LOWER("UTF8(payload)") LIKE '%create%'
       OR LOWER("UTF8(payload)") LIKE '%truncate%'
       OR LOWER("UTF8(payload)") LIKE '%rename%') THEN 1
    ELSE 0
  END AS PlistDirectWrite,
  "UTF8(payload)" AS RawPayload
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN (
  'Apple OS X', 'Syslog', 'Universal DSM', 'macOS Unified Logging'
)
AND (
  (LOWER("UTF8(payload)") LIKE '%defaults%' AND LOWER("UTF8(payload)") LIKE '%com.apple.loginwindow%')
  OR LOWER("UTF8(payload)") LIKE '%loginhook%'
  OR LOWER("UTF8(payload)") LIKE '%logouthook%'
  OR (
    LOWER("UTF8(payload)") LIKE '%loginwindow.plist%'
    AND (
      LOWER("UTF8(payload)") LIKE '%write%'
      OR LOWER("UTF8(payload)") LIKE '%create%'
      OR LOWER("UTF8(payload)") LIKE '%truncate%'
      OR LOWER("UTF8(payload)") LIKE '%rename%'
    )
  )
)
LAST 24 HOURS
ORDER BY starttime DESC

_sourceCategory=macos* OR _sourceCategory=*syslog* OR _sourceCategory=*osquery*
| where (contains(toLowerCase(_raw), "defaults") AND contains(toLowerCase(_raw), "com.apple.loginwindow"))
   OR contains(toLowerCase(_raw), "loginhook")
   OR contains(toLowerCase(_raw), "logouthook")
   OR (contains(toLowerCase(_raw), "loginwindow.plist") AND matches(_raw, "(?i)(write|create|open|truncate|rename)"))
| parse regex "(?i)(?:LoginHook|LogoutHook)\\s+(?<script_path>[/\\w.\\-]+)" nodrop
| eval hook_type = if(contains(toLowerCase(_raw), "loginhook"), "LoginHook",
    if(contains(toLowerCase(_raw), "logouthook"), "LogoutHook", "unknown"))
| eval defaults_write = if(matches(_raw, "(?i)defaults\\s+write\\s+[^\\s]*loginwindow"), 1, 0)
| eval plist_write = if(contains(toLowerCase(_raw), "loginwindow.plist") AND matches(_raw, "(?i)(write|create|truncate|rename)"), 1, 0)
| eval suspicion_score = defaults_write + plist_write + if(hook_type != "unknown", 1, 0)
| where hook_type != "unknown" OR defaults_write = 1 OR plist_write = 1
| fields _messageTime, _sourceHost, hook_type, defaults_write, plist_write, script_path, suspicion_score, _raw
| sort by _messageTime desc

rule macos_login_hook_persistence_t1037_002 {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects macOS Login Hook persistence via defaults write to loginwindow plist or direct plist modification (T1037.002)"
    severity = "HIGH"
    mitre_attack_tactic = "Persistence"
    mitre_attack_technique = "T1037.002"
    reference = "https://attack.mitre.org/techniques/T1037/002/"
    version = "1.0"

  events:
    (
      $e.metadata.event_type = "PROCESS_LAUNCH" and
      re.regex($e.target.process.file.full_path, `.*\/defaults$`) and
      re.regex($e.target.process.command_line, `com\.apple\.loginwindow`) and
      (
        re.regex($e.target.process.command_line, `LoginHook`) or
        re.regex($e.target.process.command_line, `LogoutHook`)
      )
    )
    or
    (
      $e.metadata.event_type = "FILE_MODIFICATION" and
      $e.target.file.full_path = "/Library/Preferences/com.apple.loginwindow.plist"
    )
    or
    (
      $e.metadata.event_type = "FILE_CREATION" and
      $e.target.file.full_path = "/Library/Preferences/com.apple.loginwindow.plist"
    )

  condition:
    $e
}

(#event_simpleName=ProcessRollup2 ImageFileName=/\/defaults$/ CommandLine=/com\.apple\.loginwindow/ CommandLine=/(LoginHook|LogoutHook)/)
OR (#event_simpleName=MacFileWritten FilePath=/\/Library\/Preferences\/com\.apple\.loginwindow\.plist/)
OR (#event_simpleName=MacFileCreated FilePath=/\/Library\/Preferences\/com\.apple\.loginwindow\.plist/)
| HookType := if(CommandLine = /LoginHook/, "LoginHook", if(CommandLine = /LogoutHook/, "LogoutHook", "FileMod"))
| DetectionVector := if(#event_simpleName = "ProcessRollup2", "defaults_write", "plist_direct_write")
| table([_time, ComputerName, UserName, CommandLine, FilePath, HookType, DetectionVector, #event_simpleName])
| sort(field=_time, order=desc)