Emond

DeviceFileEvents
| where Timestamp > ago(24h)
| where DeviceOSPlatform has_any ("macOS", "Mac", "Darwin")
| where (
    FolderPath has "/etc/emond.d/rules/"
    or FolderPath has "/etc/emond.d/"
    or (FileName endswith ".plist" and FolderPath has "emond")
  )
| where ActionType in ("FileCreated", "FileModified")
| extend IsRulesDir = FolderPath has "/etc/emond.d/rules/"
| extend IsNewPlist = FileName endswith ".plist"
| project Timestamp, DeviceName, AccountName, ActionType, FileName, FolderPath,
         IsRulesDir, IsNewPlist,
         InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc

index=syslog sourcetype=syslog host=*mac*
| eval IsEmondFile=if(
    match(source, "/etc/emond\.d/(rules/|startupitems/)") OR match(_raw, "emond"),
    1, 0
  )
| eval IsFileWrite=if(
    match(_raw, "(wrote|write|created|WRITE|CREATE|open.*O_CREAT|open.*O_RDWR)"),
    1, 0
  )
| eval IsPlist=if(match(_raw, "\.plist"), 1, 0)
| where IsEmondFile=1 OR (IsFileWrite=1 AND IsPlist=1 AND match(_raw, "emond"))
| table _time, host, user, _raw, IsEmondFile, IsFileWrite
| sort - _time

file where host.os.type == "macos" and
  event.type in ("creation", "change") and
  (
    file.path like "/etc/emond.d/rules/*" or
    file.path like "/etc/emond.d/*" or
    (file.extension == "plist" and file.path like "*emond*")
  )

SELECT DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
       sourceip,
       username,
       "fileName",
       "filePath",
       QIDNAME(qid) AS event_name,
       logsourceid,
       LOGSOURCETYPENAME(logsourceid) AS log_source_type,
       UTF8(payload) AS raw_event
FROM events
WHERE LOGSOURCETYPENAME(logsourceid) ILIKE '%mac%'
  AND devicetime > (CURRENT_TIMESTAMP - 86400000)
  AND (
    "filePath" ILIKE '%/etc/emond.d/rules/%'
    OR "filePath" ILIKE '%/etc/emond.d/%'
    OR ("fileName" ILIKE '%.plist' AND UTF8(payload) ILIKE '%emond%')
    OR (UTF8(payload) ILIKE '%emond.d%' AND UTF8(payload) ILIKE '%(wrote|created|modified)%')
  )
ORDER BY devicetime DESC

(_sourceCategory=*mac* OR _sourceCategory=*endpoint* OR _sourceCategory=*osquery*)
| where _raw matches "/etc/emond\.d/(rules/|startupitems/)" 
    or (_raw matches "emond" and _raw matches "\.plist")
    or _raw matches "/etc/emond\.d/"
| parse regex field=_raw "(?<action>wrote|write|created|WRITE|CREATE|FileCreate|FileWrite|modified)" nodrop
| parse regex field=_raw "(?<file_path>/etc/emond\.d/[^\s\"']+)" nodrop
| parse regex field=_raw "(?<username>user[=:\s]+(?P<uname>[\w\-\.]+))" nodrop
| eval is_rules_dir = if(file_path matches "*rules*", "true", "false")
| eval is_plist = if(file_path matches "*.plist", "true", "false")
| where action != ""
| fields _messagetime, _sourceHost, username, action, file_path, is_rules_dir, is_plist, _raw
| sort by _messagetime desc

rule macos_emond_rule_file_modification {
  meta:
    author = "Detection Engineering"
    description = "Detects file creation or modification in the macOS emond rules directory (/etc/emond.d/rules/) which can indicate persistence or privilege escalation via the Event Monitor Daemon."
    mitre_attack_tactic = "Persistence, Privilege Escalation"
    mitre_attack_technique = "T1546.014"
    severity = "HIGH"
    confidence = "HIGH"

  events:
    $e.metadata.event_type = "FILE_CREATION" or
    $e.metadata.event_type = "FILE_MODIFICATION"

    $e.principal.platform = "MAC"

    (
      re.regex($e.target.file.full_path, `/etc/emond\.d/rules/.*`) or
      re.regex($e.target.file.full_path, `/etc/emond\.d/.*`) or
      (
        re.regex($e.target.file.full_path, `.*emond.*\.plist`) or
        re.regex($e.target.file.full_path, `.*\.plist`) and
        re.regex($e.target.file.full_path, `.*emond.*`)
      )
    )

  condition:
    $e
}

#event_simpleName=/(EndOfProcess|ProcessRollup2|SyntheticProcessRollup2|FileWritten|FileCreated)/ 
| event_platform=Mac
| (
    FilePath = /\/etc\/emond\.d\/(rules\/|startupitems\/)/ OR
    FilePath = /\/etc\/emond\.d\// OR
    (FileName = /\.plist$/ AND (FilePath = /emond/ OR CommandLine = /emond/))
  )
| rename(field="ComputerName", as="hostname")
| rename(field="UserName", as="username")
| rename(field="FileName", as="file_name")
| rename(field="FilePath", as="file_path")
| rename(field="CommandLine", as="initiating_cmd")
| table([timestamp, hostname, username, file_name, file_path, initiating_cmd, #event_simpleName])
| sort(timestamp, order=desc)