alerting-detection-strategy-framework/ADS-Examples/001-Little-Snitch-Discovery-Behavior.md at master · palantir/alerting-detection-strategy-framework

Detect attempts by potentially malicious software to discover the presence of Little Snitch on a host by looking for process and command line artifacts. These attempts are categorized as Discovery / Security Software Discovery. The strategy will function as follows: Little Snitch is an application firewall for MacOS that allows users to generate rulesets around how applications can communicate on the network. In the most paranoid mode, Little Snitch will launch a pop-up notifying the user that an application has deviated from a ruleset. For instance, the following events could trip an interactive alert: A new process is observed attempting to communicate on the network. A process is communicating with a new IP address or port which differs from a ruleset. The following prompt demonstrates the expected behavior of Little Snitch: Due to the intrusive nature of Little Snitch popups, several MacOS implants will perform explicit checks for processes, kexts, and other components. This usuall

Goal Detect attempts by potentially malicious software to discover the presence of Little Snitch on a host by looking for process and command line artifacts. Categorization These attempts are categorized as Discovery / Security Software Discovery . Strategy Abstract The strategy will function as follows: Record process and process command line information for MacOS hosts using endpoint detection tooling. Look for any explicit process or command line references to Little Snitch. Suppress known-good processes and command line arguments Little Snitch Updater Little Snitch Installer Health checks

related reading

• Security incident disclosure — July 2026huggingface.co
• D3FEND Matrix | MITRE D3FEND™d3fend.mitre.org
• PerfectData Software Abuse and Account Takeover Risksdarktrace.com
• Somanasomana.tech
• GitHub - open-edge-platform/anomalib: An anomaly detection library comprising state-of-the-art algorithms and features such as experiment management, hyper-parameter optimization, and edge inference. · GitHubgithub.com
• GitHub - GitGuardian/ggshield: Detect and validate 500+ types of hardcoded secrets with advanced checks. Use it as a pre-commit hook, GitHub Action, or CLI for proactive secret detection and security. · GitHubgithub.com
• Email Compromise To Mass Phishing Campaigndarktrace.com
• Detection: BCDEdit Failure Recovery Modification | Splunk Security Contentresearch.splunk.com
• Mediumdetect.fyi
• When Intrusions Don’t Align: A New Water Watering Hole and Oldsmar | Dragosdragos.com
• Anomalies detected by the Microsoft Sentinel machine learning engine | Microsoft Learnlearn.microsoft.com
• A guide to threat hunting and monitoring in Snowflake | Datadog Security Labssecuritylabs.datadoghq.com