BIOC
Informational
✕
Common Apple process name missing Apple digital signature
These common Apple process names should normally be signed with the Apple Inc. digital signature. Naming processes with common names is a common way attackers obfuscate their activities.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- File Type Obfuscation
- Status:
- Enabled
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Masquerading (T1036)
Indicator:
Process action type = execution AND target process name = safari.exe , itunes.exe , ituneshelper.exe , ipodservice.exe , applemobiledeviceservice.exe , applemobiledevicehelper.exe AND process execution signer != *Apple Inc.* Host host os = windows
Preventable: yes