Techniques
Sample rules
Suspicious Calendar File Modification
- source: elastic
- technicques:
- T1546
Description
Identifies suspicious modifications of the calendar file by an unusual process. Adversaries may create a custom calendar notification procedure to execute a malicious program at a recurring interval to establish persistence.
Detection logic
file where host.os.type == "macos" and event.action == "modification" and
file.path like~ "/Users/*/Library/Calendars/*.calendar/Events/*.ics" and
not process.executable like ("/System/Library/*", "/System/Applications/Calendar.app/Contents/MacOS/*",
"/System/Applications/Mail.app/Contents/MacOS/Mail", "/usr/libexec/xpcproxy",
"/sbin/launchd", "/Applications/*")