From cfa475905fbf9358abd5ca72b5494e3a8f7617f8 Mon Sep 17 00:00:00 2001 From: Radka Date: Fri, 18 Sep 2026 14:20:10 +0200 Subject: [PATCH 1/6] Add macOS osascript long-lived connection detection --- ...t_long_lived_connection_to_remote_host.yml | 88 +++++++++++++++++++ 1 file changed, 88 insertions(+) create mode 100644 detections/endpoint/macos_osascript_long_lived_connection_to_remote_host.yml diff --git a/detections/endpoint/macos_osascript_long_lived_connection_to_remote_host.yml b/detections/endpoint/macos_osascript_long_lived_connection_to_remote_host.yml new file mode 100644 index 0000000000..cd38be79be --- /dev/null +++ b/detections/endpoint/macos_osascript_long_lived_connection_to_remote_host.yml @@ -0,0 +1,88 @@ +name: MacOS Osascript Long Lived Connection to Remote Host +id: 6bc88a9d-f7de-4257-b526-acf15bc5a517 +version: 1 +creation_date: '2026-09-18' +modification_date: '2026-09-18' +author: Radka Viskova, Splunk +status: production +type: Anomaly +description: Utility osascript on a macOS device initiated a network connection lasting longer than 10 minutes. Adversaries may abuse osascript and AppleScript shell execution to establish long-lived command-and-control or remote connections. +data_source: + - Cisco Network Visibility Module Flow Data +search: |- + `cisco_network_visibility_module_flowdata` + | eval ParentImage=lower(ppn), + ParentPath=lower(pppath), + StartTimeAsUnix=tonumber(fsms), + EndTimeAsUnix=tonumber(fems), + duration_minutes=round((EndTimeAsUnix-StartTimeAsUnix)/60000,2) + + | where ( + ParentImage="osascript" + OR like(ParentPath,"%/osascript") + ) + AND isnotnull(StartTimeAsUnix) + AND isnotnull(EndTimeAsUnix) + AND EndTimeAsUnix > StartTimeAsUnix + 600000 + + | stats count + min(StartTimeAsUnix) as firstTime + max(EndTimeAsUnix) as lastTime + max(duration_minutes) as duration_minutes + values(ppn) as parent_process_name + values(pppath) as parent_process_path + values(pparg) as parent_process_arguments + values(ppath) as process_path + values(dest) as dest + values(dh) as dest_hostname + values(dp) as dest_port + by host src udid + + | eval firstTime=firstTime/1000, + lastTime=lastTime/1000 + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + + | table firstTime lastTime host src udid dest dest_hostname dest_port duration_minutes parent_process_name parent_process_path parent_process_arguments process_path + + | `macos_osascript_long_lived_connection_to_remote_host_filter` +how_to_implement: |- + how_to_implement: |- + This detection requires Cisco Network Visibility Module flow data ingested through the Cisco Endpoint Security Analytics Add-on for Splunk. The `cisco_network_visibility_module_flowdata` macro must be configured for the local index, source, and sourcetype. The search uses the raw NVM fields `fsms` and `fems`, which may also be aliased as `flow_start_msec` and `flow_end_msec`. +known_false_positives: |- + Legitimate administrative scripting, automation, software deployment, or support workflows that use osascript for long-running network operations. +references: + - https://attack.mitre.org/tactics/TA0002/ + - https://attack.mitre.org/tactics/TA0011/ + - https://attack.mitre.org/techniques/T1059/002/ + - https://attack.mitre.org/techniques/T1059/004/ + - https://www.loobins.io/binaries/osascript/ +analytic_story: + - Cisco Network Visibility Module Analytics +asset_type: Endpoint +mitre_attack_id: + - T1059.002 + - T1059.004 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: endpoint +security_domain: endpoint +intermediate_findings: + entities: + - field: src + type: system + score: 20 + message: The macOS host $src$ used $parent_process_name$ to initiate a network connection to $dest_hostname$ lasting $duration_minutes$ minutes. +threat_objects: + - field: parent_process_name + type: process_name +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/21dc8cc7dcde97dc412092c31d3a6500832f1f0e/datasets/attack_techniques/T1059.002/osascript_long_lived_connection_to_remote_host/osascript_long_lived_connection_to_remote_host.log + source: not_applicable + sourcetype: cisco:nvm:flowdata:v2 + test_type: unit From 71936461699cc7be60bf9b33b548d47363d93165 Mon Sep 17 00:00:00 2001 From: Radka Date: Fri, 18 Sep 2026 14:51:38 +0200 Subject: [PATCH 2/6] fixed formatting differences --- ...pt_long_lived_connection_to_remote_host.yml | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/detections/endpoint/macos_osascript_long_lived_connection_to_remote_host.yml b/detections/endpoint/macos_osascript_long_lived_connection_to_remote_host.yml index cd38be79be..f9f8750710 100644 --- a/detections/endpoint/macos_osascript_long_lived_connection_to_remote_host.yml +++ b/detections/endpoint/macos_osascript_long_lived_connection_to_remote_host.yml @@ -58,6 +58,15 @@ references: - https://attack.mitre.org/techniques/T1059/002/ - https://attack.mitre.org/techniques/T1059/004/ - https://www.loobins.io/binaries/osascript/ +intermediate_findings: + entities: + - field: src + type: system + score: 20 + message: The macOS host $src$ used $parent_process_name$ to initiate a network connection to $dest_hostname$ lasting $duration_minutes$ minutes. +threat_objects: + - field: parent_process_name + type: process_name analytic_story: - Cisco Network Visibility Module Analytics asset_type: Endpoint @@ -70,15 +79,6 @@ product: - Splunk Cloud category: endpoint security_domain: endpoint -intermediate_findings: - entities: - - field: src - type: system - score: 20 - message: The macOS host $src$ used $parent_process_name$ to initiate a network connection to $dest_hostname$ lasting $duration_minutes$ minutes. -threat_objects: - - field: parent_process_name - type: process_name tests: - name: True Positive Test attack_data: From 383c31241f62ff692f88c7b6250a54e121003fc0 Mon Sep 17 00:00:00 2001 From: Radka Date: Fri, 18 Sep 2026 15:06:02 +0200 Subject: [PATCH 3/6] fixed formatting differences, added missing drilldown searches --- ...t_long_lived_connection_to_remote_host.yml | 29 ++++++++++--------- 1 file changed, 16 insertions(+), 13 deletions(-) diff --git a/detections/endpoint/macos_osascript_long_lived_connection_to_remote_host.yml b/detections/endpoint/macos_osascript_long_lived_connection_to_remote_host.yml index f9f8750710..14bf95f2db 100644 --- a/detections/endpoint/macos_osascript_long_lived_connection_to_remote_host.yml +++ b/detections/endpoint/macos_osascript_long_lived_connection_to_remote_host.yml @@ -6,7 +6,8 @@ modification_date: '2026-09-18' author: Radka Viskova, Splunk status: production type: Anomaly -description: Utility osascript on a macOS device initiated a network connection lasting longer than 10 minutes. Adversaries may abuse osascript and AppleScript shell execution to establish long-lived command-and-control or remote connections. +description: |- + Utility osascript on a macOS device initiated a network connection lasting longer than 10 minutes. Adversaries may abuse osascript and AppleScript shell execution to establish long-lived command-and-control or remote connections. data_source: - Cisco Network Visibility Module Flow Data search: |- @@ -16,7 +17,6 @@ search: |- StartTimeAsUnix=tonumber(fsms), EndTimeAsUnix=tonumber(fems), duration_minutes=round((EndTimeAsUnix-StartTimeAsUnix)/60000,2) - | where ( ParentImage="osascript" OR like(ParentPath,"%/osascript") @@ -24,7 +24,6 @@ search: |- AND isnotnull(StartTimeAsUnix) AND isnotnull(EndTimeAsUnix) AND EndTimeAsUnix > StartTimeAsUnix + 600000 - | stats count min(StartTimeAsUnix) as firstTime max(EndTimeAsUnix) as lastTime @@ -36,19 +35,14 @@ search: |- values(dest) as dest values(dh) as dest_hostname values(dp) as dest_port - by host src udid - + by src udid dest dh dp ppn pppath ppath | eval firstTime=firstTime/1000, lastTime=lastTime/1000 - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - - | table firstTime lastTime host src udid dest dest_hostname dest_port duration_minutes parent_process_name parent_process_path parent_process_arguments process_path - + | table firstTime lastTime src udid dest dest_hostname dest_port duration_minutes parent_process_name parent_process_path parent_process_arguments process_path | `macos_osascript_long_lived_connection_to_remote_host_filter` how_to_implement: |- - how_to_implement: |- This detection requires Cisco Network Visibility Module flow data ingested through the Cisco Endpoint Security Analytics Add-on for Splunk. The `cisco_network_visibility_module_flowdata` macro must be configured for the local index, source, and sourcetype. The search uses the raw NVM fields `fsms` and `fems`, which may also be aliased as `flow_start_msec` and `flow_end_msec`. known_false_positives: |- Legitimate administrative scripting, automation, software deployment, or support workflows that use osascript for long-running network operations. @@ -58,6 +52,15 @@ references: - https://attack.mitre.org/techniques/T1059/002/ - https://attack.mitre.org/techniques/T1059/004/ - https://www.loobins.io/binaries/osascript/ +drilldown_searches: + - name: View detection results for "$src$" and "$dest$" + search: '%original_detection_search% | search src="$src$" dest="$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for "$src$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" intermediate_findings: entities: - field: src @@ -65,8 +68,8 @@ intermediate_findings: score: 20 message: The macOS host $src$ used $parent_process_name$ to initiate a network connection to $dest_hostname$ lasting $duration_minutes$ minutes. threat_objects: - - field: parent_process_name - type: process_name + - field: parent_process_name + type: process_name analytic_story: - Cisco Network Visibility Module Analytics asset_type: Endpoint @@ -85,4 +88,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/21dc8cc7dcde97dc412092c31d3a6500832f1f0e/datasets/attack_techniques/T1059.002/osascript_long_lived_connection_to_remote_host/osascript_long_lived_connection_to_remote_host.log source: not_applicable sourcetype: cisco:nvm:flowdata:v2 - test_type: unit + test_type: unit \ No newline at end of file From 0c4cb303a60181a27976bbf71e4136935b854fa2 Mon Sep 17 00:00:00 2001 From: Radka Date: Fri, 18 Sep 2026 16:06:07 +0200 Subject: [PATCH 4/6] additional format fixes --- .../macos_osascript_long_lived_connection_to_remote_host.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/detections/endpoint/macos_osascript_long_lived_connection_to_remote_host.yml b/detections/endpoint/macos_osascript_long_lived_connection_to_remote_host.yml index 14bf95f2db..6f0958a53f 100644 --- a/detections/endpoint/macos_osascript_long_lived_connection_to_remote_host.yml +++ b/detections/endpoint/macos_osascript_long_lived_connection_to_remote_host.yml @@ -6,8 +6,7 @@ modification_date: '2026-09-18' author: Radka Viskova, Splunk status: production type: Anomaly -description: |- - Utility osascript on a macOS device initiated a network connection lasting longer than 10 minutes. Adversaries may abuse osascript and AppleScript shell execution to establish long-lived command-and-control or remote connections. +description: Utility osascript on a macOS device initiated a network connection lasting longer than 10 minutes. Adversaries may abuse osascript and AppleScript shell execution to establish long-lived command-and-control or remote connections. data_source: - Cisco Network Visibility Module Flow Data search: |- From 572313dd4e044b643710ae558e701ca859ecb24c Mon Sep 17 00:00:00 2001 From: Radka Date: Fri, 18 Sep 2026 18:32:13 +0200 Subject: [PATCH 5/6] formated Osascript long lived connection to remote host detection --- .../macos_osascript_long_lived_connection_to_remote_host.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/macos_osascript_long_lived_connection_to_remote_host.yml b/detections/endpoint/macos_osascript_long_lived_connection_to_remote_host.yml index 6f0958a53f..7e67d4387b 100644 --- a/detections/endpoint/macos_osascript_long_lived_connection_to_remote_host.yml +++ b/detections/endpoint/macos_osascript_long_lived_connection_to_remote_host.yml @@ -87,4 +87,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/21dc8cc7dcde97dc412092c31d3a6500832f1f0e/datasets/attack_techniques/T1059.002/osascript_long_lived_connection_to_remote_host/osascript_long_lived_connection_to_remote_host.log source: not_applicable sourcetype: cisco:nvm:flowdata:v2 - test_type: unit \ No newline at end of file + test_type: unit From 4f7e1999d1c39f37d005834dada6f60ac0f42cca Mon Sep 17 00:00:00 2001 From: Radka Date: Fri, 18 Sep 2026 19:04:14 +0200 Subject: [PATCH 6/6] fixed long-lived osascript connection detection search --- .../macos_osascript_long_lived_connection_to_remote_host.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/detections/endpoint/macos_osascript_long_lived_connection_to_remote_host.yml b/detections/endpoint/macos_osascript_long_lived_connection_to_remote_host.yml index 7e67d4387b..273561da0e 100644 --- a/detections/endpoint/macos_osascript_long_lived_connection_to_remote_host.yml +++ b/detections/endpoint/macos_osascript_long_lived_connection_to_remote_host.yml @@ -31,7 +31,6 @@ search: |- values(pppath) as parent_process_path values(pparg) as parent_process_arguments values(ppath) as process_path - values(dest) as dest values(dh) as dest_hostname values(dp) as dest_port by src udid dest dh dp ppn pppath ppath