2022-10-13 18:59:32 +00:00
|
|
|
-- Unexpected launchd scripts that use the 'program' field
|
2022-10-12 01:53:36 +00:00
|
|
|
--
|
2022-10-14 18:19:13 +00:00
|
|
|
-- references:
|
|
|
|
|
-- * https://attack.mitre.org/techniques/T1543/004/
|
|
|
|
|
--
|
|
|
|
|
-- false positives:
|
|
|
|
|
-- * Software by new vendors which have not yet been added to the allow list
|
|
|
|
|
--
|
2022-10-14 18:26:49 +00:00
|
|
|
-- tags: persistent filesystem state
|
2022-10-12 01:53:36 +00:00
|
|
|
-- platform: darwin
|
2022-09-24 15:12:23 +00:00
|
|
|
SELECT
|
|
|
|
|
l.label,
|
|
|
|
|
l.name,
|
|
|
|
|
l.path,
|
|
|
|
|
l.program,
|
|
|
|
|
l.program_arguments,
|
|
|
|
|
l.keep_alive,
|
|
|
|
|
signature.authority AS program_authority,
|
|
|
|
|
signature.identifier AS program_identifier,
|
|
|
|
|
hash.sha256
|
|
|
|
|
FROM
|
|
|
|
|
launchd l
|
|
|
|
|
LEFT JOIN signature ON l.program = signature.path
|
|
|
|
|
LEFT JOIN hash ON l.path = hash.path
|
|
|
|
|
WHERE
|
|
|
|
|
(
|
|
|
|
|
run_at_load = 1
|
|
|
|
|
OR keep_alive = 1
|
|
|
|
|
)
|
2022-10-13 18:59:32 +00:00
|
|
|
AND l.path NOT LIKE '/System/%'
|
2022-09-24 15:12:23 +00:00
|
|
|
AND program IS NOT NULL
|
|
|
|
|
AND program_authority NOT IN (
|
|
|
|
|
'Developer ID Application: Adobe Inc. (JQ525L2MZD)',
|
|
|
|
|
'Developer ID Application: Docker Inc (9BNSXJN65R)',
|
|
|
|
|
'Developer ID Application: Logitech Inc. (QED4VVPZWA)',
|
|
|
|
|
'Developer ID Application: Microsoft Corporation (UBF8T346G9)',
|
|
|
|
|
'Developer ID Application: Objective Development Software GmbH (MLZF7K7B5R)',
|
|
|
|
|
'Developer ID Application: Oracle America, Inc. (VB5E2TV963)',
|
|
|
|
|
'Developer ID Application: Valve Corporation (MXGJJ98X76)',
|
|
|
|
|
'Developer ID Application: Wireshark Foundation, Inc. (7Z6EMTD2C6)'
|
|
|
|
|
)
|
|
|
|
|
AND program NOT IN ('/usr/local/MacGPG2/libexec/shutdown-gpg-agent')
|
