flâneur

alerting-detection-strategy-framework/ADS-Examples/001-Little-Snitch-Discovery-Behavior.md at master · palantir/alerting-detection-strategy-framework

github.com · 867 words · saved by 1 readers

Detect attempts by potentially malicious software to discover the presence of Little Snitch on a host by looking for process and command line artifacts. These attempts are categorized as Discovery / Security Software Discovery. The strategy will function as follows: Little Snitch is an application firewall for MacOS that allows users to generate rulesets around how applications can communicate on the network. In the most paranoid mode, Little Snitch will launch a pop-up notifying the user that an application has deviated from a ruleset. For instance, the following events could trip an interactive alert: A new process is observed attempting to communicate on the network. A process is communicating with a new IP address or port which differs from a ruleset. The following prompt demonstrates the expected behavior of Little Snitch: Due to the intrusive nature of Little Snitch popups, several MacOS implants will perform explicit checks for processes, kexts, and other components. This usuall

Goal Detect attempts by potentially malicious software to discover the presence of Little Snitch on a host by looking for process and command line artifacts. Categorization These attempts are categorized as Discovery / Security Software Discovery . Strategy Abstract The strategy will function as follows: Record process and process command line information for MacOS hosts using endpoint detection tooling. Look for any explicit process or command line references to Little Snitch. Suppress known-good processes and command line arguments Little Snitch Updater Little Snitch Installer Health checks

related reading