LoFP / authorized softwareupdate settings changes

Techniques

• T1562

Sample rules

SoftwareUpdate Preferences Modification

• source: elastic
• technicques:
  • T1562

Description

Identifies changes to the SoftwareUpdate preferences using the built-in defaults command. Adversaries may abuse this in an attempt to disable security updates.

Detection logic

event.category:process and host.os.type:macos and event.type:(start or process_started) and
 process.name:defaults and
 process.args:(write and "-bool" and (com.apple.SoftwareUpdate or /Library/Preferences/com.apple.SoftwareUpdate.plist) and not (TRUE or true))