Techniques › T1204.002 › AN0820
AN0820 Analytic 0820
macOS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>User opens a downloaded document/installer leading to EndpointSecurity file create in ~/Downloads or ~/Library paths then an exec of a suspicious utility (osascript, bash/zsh, curl, chmod, open with -a Terminal). Correlates File Creation with subsequent process exec and, optionally, quarantine/LSQuarantine events.</p>
- Detects
- T1204.002 Malicious File
- Part of
- DET0294 User Execution – Malicious File via download/open → spawn chain (T1204.002)
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| macos:unifiedlog | process_exec: image in {/bin/bash,/bin/zsh,/usr/bin/osascript,/usr/bin/python*,/usr/bin/curl,/usr/bin/ssh,/usr/bin/open} AND parent in {Preview, TextEdit, Microsoft Word, Microsoft Excel, AdobeReader, Archive Utility, Finder} | DC0032 Process Creation |
| macos:endpointsecurity | ES_EVENT_TYPE_NOTIFY_CREATE: path under /Users/*/(Downloads|Desktop|Library/*/Containers|Library/Group Containers) AND extension in SuspiciousExtensions | DC0039 File Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TimeWindow | Correlation window between file create and exec (e.g., ≤10m). |
QuarantineRequired | Require com.apple.quarantine attribute present on the file for higher fidelity. |
ParentApps | Approved document viewers/editors to anchor lineage. |
KEV CVEs whose mapped technique this analytic detects
| CVE | Vendor / product | State |
|---|---|---|
| CVE-2007-5659 | Adobe Acrobat and Reader | Mapped |
| CVE-2008-0655 | Adobe Acrobat and Reader | Mapped |
| CVE-2008-2992 | Adobe Acrobat and Reader | Mapped |
| CVE-2009-1862 | Adobe Acrobat and Reader, Flash Player | Mapped |
| CVE-2009-3953 | Adobe Acrobat and Reader | Mapped |
| CVE-2009-4324 | Adobe Acrobat and Reader | Mapped |
| CVE-2010-1297 | Adobe Flash Player | Mapped |
| CVE-2010-2883 | Adobe Acrobat and Reader | Mapped |
| CVE-2011-0611 | Adobe Flash Player | Mapped |
| CVE-2011-2462 | Adobe Reader and Acrobat | Mapped |
| CVE-2012-0754 | Adobe Flash Player | Mapped |
| CVE-2012-1535 | Adobe Flash Player | Mapped |
| CVE-2013-0641 | Adobe Reader | Mapped |
| CVE-2014-0496 | Adobe Reader and Acrobat | Mapped |
| CVE-2015-3043 | Adobe Flash Player | Mapped |
| CVE-2015-3113 | Adobe Flash Player | Mapped |
| CVE-2015-7645 | Adobe Flash Player | Mapped |
| CVE-2016-0984 | Adobe Flash Player and AIR | Mapped |
| CVE-2016-4117 | Adobe Flash Player | Mapped |
| CVE-2017-11292 | Adobe Flash Player | Mapped |
| CVE-2018-15982 | Adobe Flash Player | Mapped |
| CVE-2018-4878 | Adobe Flash Player | Mapped |
| CVE-2018-4990 | Adobe Acrobat and Reader | Mapped |
| CVE-2021-21017 | Adobe Acrobat and Reader | Mapped |
| CVE-2021-28550 | Adobe Acrobat and Reader | Mapped |
| CVE-2022-30190 | Microsoft Windows | Mapped |
| CVE-2022-34713 | Microsoft Windows | Mapped |
| CVE-2023-21608 | Adobe Acrobat and Reader | Mapped |
| CVE-2023-21715 | Microsoft Office | Mapped |
| CVE-2023-26369 | Adobe Acrobat and Reader | Mapped |
| CVE-2023-36884 | Microsoft Windows | Stale |
| CVE-2024-38080 | Microsoft Windows | Mapped |
| CVE-2025-27363 | FreeType FreeType | Mapped |