Techniques
Sample rules
SoftwareUpdate Preferences Modification
- source: elastic
- technicques:
- T1562
Description
Identifies changes to the SoftwareUpdate preferences using the built-in defaults command. Adversaries may abuse this in an attempt to disable security updates.
Detection logic
process where host.os.type == "macos" and event.type in ("start", "process_started") and
process.name == "defaults" and
process.args like "write" and process.args like "-bool" and process.args like~ ("com.apple.SoftwareUpdate", "/Library/Preferences/com.apple.SoftwareUpdate.plist") and not process.args like ("TRUE", "true")