LoFP / legitimate activities

condition: selection
selection:
  Image|endswith:
  - /who
  - /w
  - /last
  - /lsof
  - /netstat

condition: selection
selection:
  CommandLine|contains: -d
  Image: /usr/bin/base64

condition: selection
selection:
  CommandLine|contains|all:
  - -d
  - com.apple.quarantine
  Image|endswith: /xattr

condition: 1 of select*
select_file_with_asterisk:
  CommandLine|re: (.){200,}
  Image: /usr/bin/file
select_find_execution:
  Image: /usr/bin/find
select_mdfind_execution:
  Image: /usr/bin/mdfind
select_recursive_ls:
  CommandLine|contains: -R
  Image: /bin/ls
select_tree_execution|endswith:
  Image: /tree

condition: (launchctl_unload and security_plists) or disable_gatekeeper
disable_gatekeeper:
  CommandLine|contains: disable
  Image: /usr/sbin/spctl
launchctl_unload:
  CommandLine|contains: unload
  Image: /bin/launchctl
security_plists:
  CommandLine|contains:
  - com.objective-see.lulu.plist
  - com.objective-see.blockblock.plist
  - com.google.santad.plist
  - com.carbonblack.defense.daemon.plist
  - com.carbonblack.daemon.plist
  - at.obdev.littlesnitchd.plist
  - com.tenablesecurity.nessusagent.plist
  - com.opendns.osx.RoamingClientConfigUpdater.plist
  - com.crowdstrike.falcond.plist
  - com.crowdstrike.userdaemon.plist
  - osquery
  - filebeat
  - auditbeat
  - packetbeat
  - td-agent

condition: image and 1 of selection_cli_*
image:
  Image: /usr/bin/grep
selection_cli_1:
  CommandLine|contains:
  - nessusd
  - santad
  - CbDefense
  - falcond
  - td-agent
  - packetbeat
  - filebeat
  - auditbeat
  - osqueryd
  - BlockBlock
  - LuLu
selection_cli_2:
  CommandLine|contains|all:
  - Little
  - Snitch

condition: selection and not 1 of filter_*
filter_landscape_sysinfo:
  Image|endswith: /who
  ParentCommandLine|contains: /usr/bin/landscape-sysinfo
selection:
  Image|endswith:
  - /who
  - /w
  - /last
  - /lsof
  - /netstat

condition: 1 of select*
select_file_with_asterisk:
  CommandLine|re: (.){200,}
  Image|endswith: /file
select_find_execution:
  Image|endswith: /find
select_recursive_ls:
  CommandLine|contains: -R
  Image|endswith: /ls
select_tree_execution:
  Image|endswith: /tree

condition: selection
selection:
  CommandLine|contains:
  - nessusd
  - td-agent
  - packetbeat
  - filebeat
  - auditbeat
  - osqueryd
  - cbagentd
  - falcond
  Image|endswith:
  - /grep
  - /egrep

condition: selection
selection:
  CommandLine|contains: -d
  Image|endswith: /base64