LoFP LoFP / trusted applications for managing calendars and reminders.

Techniques

Sample rules

Suspicious Calendar File Modification

Description

Identifies suspicious modifications of the calendar file by an unusual process. Adversaries may create a custom calendar notification procedure to execute a malicious program at a recurring interval to establish persistence.

Detection logic

file where host.os.type == "macos" and event.action == "modification" and
  file.path like~ "/Users/*/Library/Calendars/*.calendar/Events/*.ics" and
  not process.executable like ("/System/Library/*", "/System/Applications/Calendar.app/Contents/MacOS/*", 
                               "/System/Applications/Mail.app/Contents/MacOS/Mail", "/usr/libexec/xpcproxy",
                               "/sbin/launchd", "/Applications/*")