Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

2 alerts match the current filters. tactic: TA0002 ✕ technique: T1555 ✕

Download CSV Show ATT&CK heatmap
  • Uncommon AppleScript designed to access credential files was executed via the command line Medium

    The AppleScript interpreter was executed with a script designed to access credential files such as keychains or SSH keys.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    1 Day
    ATT&CK tactics: Execution (TA0002) Credential Access (TA0006)
    ATT&CK techniques: Command and Scripting Interpreter: AppleScript (T1059.002) Credentials from Password Stores (T1555)
    Required data: XDR Agent
    Detector tags: AppleScript Analytics, Sensitive Information Stealing Analytics
    Attacker's goals: Access stored credentials such as keychains and SSH keys for lateral movement or unauthorized access.
    Investigative actions: Identify which credential files were targeted (keychain, SSH authorized_keys, etc.). Check if credentials or authentication tokens were extracted. Verify the legitimacy of the file access attempt and whether it aligns with the user's normal activity. Examine child processes for signs of data exfiltration.
  • Uncommon AppleScript potentially utilizes credential-grabbing techniques to steal user passwords Low 1 variation

    The AppleScript interpreter potentially utilizes credential-grabbing techniques to steal user passwords.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    1 Day
    ATT&CK tactics: Execution (TA0002) Credential Access (TA0006)
    ATT&CK techniques: Command and Scripting Interpreter: AppleScript (T1059.002) Credentials from Password Stores (T1555)
    Required data: XDR Agent
    Detector tags: AppleScript Analytics, Credentials Grabbing Analytics
    Attacker's goals: Harvest user credentials and passwords from sensitive locations such as the macOS Keychain or directory services to enable unauthorized access, lateral movement, or privilege escalation.
    Investigative actions: Analyze the command line and determine whether it performs any malicious or suspicious actions. Check the events generated by the process or its children for potential malicious behavior. Check whether the process was executed in an unusual way.

    Variations

    Uncommon AppleScript potentially utilizes credential-grabbing techniques to steal user passwords leveraging the 'dscl -authonly' command to covertly verify the captured password

    High overridden

    The AppleScript interpreter potentially utilizes credential-grabbing techniques to steal user passwords. overridden