Techniques › T1546.014 › AN1534
AN1534 Analytic 1534
macOS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detection focuses on identifying unauthorized file creation or modification within
/etc/emond.d/rules/ or /private/var/db/emondClients, which indicate attempts to register a malicious emond rule. Correlate with process execution of /sbin/emond and any launched commands it invokes, especially during boot or login events. Anomalies may include rules created by non-root users or unexpected shell commands executed by emond.</p>- Detects
- T1546.014 Emond
- Part of
- DET0555 Detection Strategy for Event Triggered Execution via emond on macOS
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| macos:unifiedlog | file create or modify in /etc/emond.d/rules or /private/var/db/emondClients | DC0039 File Creation |
| macos:unifiedlog | execution of /sbin/emond with child processes launched | DC0032 Process Creation |
| macos:unifiedlog | rule definitions written to emond rule plists | DC0061 File Modification |
| macos:unifiedlog | command execution triggered by emond (e.g., shell, curl, python) | DC0064 Command Execution |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
PathPrefix | Paths such as `/etc/emond.d/rules/` and `/private/var/db/emondClients` may vary slightly or be symlinked in some setups |
TimeWindow | The time range for correlating rule file creation to emond execution may be tuned based on system performance and usage |
ParentProcessFilter | Defenders may wish to restrict alerts to emond processes not spawned from trusted system update or provisioning tools |
CommandPatternList | List of known suspicious commands or binaries used by adversaries (e.g., reverse shells, persistence scripts) |