LoFP LoFP / authorized softwareupdate settings changes

Techniques

Sample rules

SoftwareUpdate Preferences Modification

Description

Identifies changes to the SoftwareUpdate preferences using the built-in defaults command. Adversaries may abuse this in an attempt to disable security updates.

Detection logic

process where host.os.type == "macos" and event.type in ("start", "process_started") and
 process.name == "defaults" and
 process.args like "write" and process.args like "-bool" and process.args like~ ("com.apple.SoftwareUpdate", "/Library/Preferences/com.apple.SoftwareUpdate.plist") and not process.args like ("TRUE", "true")