Adversaries collecting local files via PowerShell, WMI, or direct file API calls often include recursive file listings, targeted file reads, and temporary file staging.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | WinEventLog:Security | EventCode=4688 |
| File Creation (DC0039) | WinEventLog:Sysmon | EventCode=11 |
| Field | Description |
|---|---|
| TargetFilePathRegex | Allows tuning for file extensions or paths of sensitive data (e.g., *.xls, *.db, *.pdf). |
| ParentProcessFilter | Used to scope monitoring to suspicious parent/child process trees like PowerShell or WMI spawning file reads. |
Adversaries using bash scripts or tools to recursively enumerate user home directories, config files, or SSH keys.
| Data Component | Name | Channel |
|---|---|---|
| File Access (DC0055) | auditd:SYSCALL | open |
| Process Creation (DC0032) | auditd:SYSCALL | execve |
| Field | Description |
|---|---|
| TimeWindow | Time span to correlate multiple file access events indicative of scripted or bulk access. |
| ScriptToolName | List of tools (e.g., `find`, `grep`, `tar`, `scp`) that may be benign but are context-sensitive. |
Adversary use of bash/zsh or AppleScript to locate files and exfil targets like user keychains or documents.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | macos:unifiedlog | process:spawn |
| File Access (DC0055) | fs:fsusage | read/write |
| Field | Description |
|---|---|
| UserContext | Useful for excluding known admin or scheduled jobs. |
| TargetVolume | Focus monitoring on removable drives or external paths. |
Collection of device configuration via CLI commands (e.g., show running-config, copy flash, more), often followed by TFTP/SCP transfers.
| Data Component | Name | Channel |
|---|---|---|
| Command Execution (DC0064) | networkdevice:cli | command logging |
| Field | Description |
|---|---|
| CommandScope | Defines list of configuration or diagnostic commands to monitor. |
| AuthenticatedUserList | Helps reduce false positives by whitelisting known admins. |
Adversaries accessing datastore or configuration files via vim-cmd, esxcli, or SCP to extract logs, VMs, or host configurations.
| Data Component | Name | Channel |
|---|---|---|
| File Access (DC0055) | esxis:vmkernel | Datastore Access |
| Command Execution (DC0064) | esxi:hostd | Command Execution |
| Field | Description |
|---|---|
| AccessPathRegex | Regex for filtering targeted VM paths or files like *.vmdk, *.vmx. |
| InteractiveShellUsage | Tune to distinguish between interactive and script-driven data access. |