Techniques › T1546 › T1546.014
T1546.014 Emond
privilege escalation · persistence — macOS · attack.mitre.org · JSON
1
MITRE detection strategy
1
analytics
1
Sigma rules tagged attack.t1546.014
0
KEV CVEs mapped here
<p>Adversaries may gain persistence and elevate privileges by executing malicious content triggered by the Event Monitor Daemon (emond). Emond is a Launch Daemon that accepts events from various services, runs them through a simple rules engine, and takes action. The emond binary at <code>/sbin/emond</code> will load any rules from the <code>/etc/emond.d/rules/</code> directory and take action once an explicitly defined event takes place.</p><p>The rule files are in the plist format and define the name, event type, and action to take. Some examples of event types include system startup and user authentication. Examples of actions are to run a system command or send an email. The emond service will not launch if there is no file present in the QueueDirectories path <code>/private/var/db/emondClients</code>, specified in the Launch Daemon configuration file at<code>/System/Library/LaunchDaemons/com.apple.emond.plist</code>.</p><p>Adversaries may abuse this service by writing a rule to execute commands when a defined event occurs, such as system start up or user authentication. Adversaries may also be able to escalate privileges from administrator to root as the emond service is executed with root privileges by the Launch Daemon service.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0555 Detection Strategy for Event Triggered Execution via emond on macOS v1.0
AN1534 macOSDetection focuses on identifying unauthorized file creation or modification within
/etc/emond.d/rules/or/private/var/db/emondClients, which indicate attempts to register a malicious emond rule. Correlate with process execution of/sbin/emondand any launched commands it invokes, especially during boot or login events. Anomalies may include rules created by non-root users or unexpected shell commands executed by emond.macos:unifiedlogfile create or modify in /etc/emond.d/rules or /private/var/db/emondClients→ DC0039 File Creationmacos:unifiedlogcommand execution triggered by emond (e.g., shell, curl, python)→ DC0064 Command ExecutionTunable:PathPrefixTimeWindowParentProcessFilterCommandPatternList
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1546.014
Author: Alejandro Ortuno, oscd.community
· 2020-10-23 (modified 2021-11-27) · logsource: product=macos category=file_event · 23c43900-e732-45a4-8354-63e4a6c187ce
Detects additions to the Emond Launch Daemon that adversaries may use to gain persistence and elevate privileges.
Rules tagged at the parent level (attack.t1546) 10
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Omkar Gudhate
· 2020-09-27 (modified 2023-09-28) · logsource: product=windows category=registry_set · 07743f65-7ec9-404a-a519-913db7118a8d
Detects changes to 'HKCU\Software\Classes\Folder\shell\open\command\DelegateExecute'
Author: Kyaw Min Thein, Furkan Caliskan (@caliskanfurkan_)
· 2020-06-22 (modified 2023-10-11) · logsource: product=windows category=process_creation · 0ba863e6-def5-4e50-9cea-4dd8c7dc46a4
Detects the malicious use of a control panel item
Author: frack113
· 2022-04-23 · logsource: product=windows category=file_event · 0c3fac91-5627-46e8-a6a8-a0d7b9b8ae1b
Get-Variable is a valid PowerShell cmdlet
WindowsApps is by default in the path where PowerShell is executed.
So when the Get-Variable command is issued on PowerShell execution, the system first looks for the Get-Variable executable in the path and executes the malicious binary instead of looking for the PowerShell cmdlet.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-02-08 · logsource: product=windows category=file_event · 117d3d3a-755c-4a61-b23e-9171146d094c
Detects the creation of a macro file for Outlook.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2021-04-05 (modified 2023-08-17) · logsource: product=windows category=registry_set · 396ae3eb-4174-4b9b-880e-dc0364d78a19
Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the automatic loading of any configured VBA project/module
Author: Denis Szadkowski, DIRT / DCSO CyTec
· 2022-10-09 · logsource: product=windows service=application · 711ab2fe-c9ba-4746-8840-5228a58c3cb8
This rule detects the execution of the extended storage procedure backdoor named Maggie in the context of Microsoft SQL server
Author: MSTIC, FPT.EagleEye
· 2021-06-15 (modified 2022-10-09) · logsource: product=windows category=process_creation · 7ba08e95-1e0b-40cd-9db5-b980555e42fd
Suspicious behaviours related to an actor tracked by Microsoft as SOURGUM
Author: @ScoubiMtl
· 2021-04-05 (modified 2023-02-08) · logsource: product=windows category=file_event · 8c31f563-f9a7-450c-bfa8-35f8f32f1f61
Detects the creation of a macro file for Outlook.
Author: Florian Roth (Nextron Systems)
· 2021-03-09 (modified 2023-03-09) · logsource: product=windows category=process_creation · bbb2dedd-a0e3-46ab-ba6c-6c82ae7a9aa7
Detects activity observed by different researchers to be HAFNIUM group activity (or related) on Exchange servers
Author: @ScoubiMtl
· 2021-04-05 (modified 2023-08-17) · logsource: product=windows category=registry_set · e3b50fa5-3c3f-444e-937b-0a99d33731cd
Detects the modification of Outlook security setting to allow unprompted execution of macros.