Skip to content

[New] Endpoint Rule Conversion PR#5658

Open
DefSecSentinel wants to merge 22 commits intomainfrom
migrate
Open

[New] Endpoint Rule Conversion PR#5658
DefSecSentinel wants to merge 22 commits intomainfrom
migrate

Conversation

@DefSecSentinel
Copy link
Contributor

@DefSecSentinel DefSecSentinel commented Jan 30, 2026 •
edited by Mikaayenson
Loading

Pull Request

Issue link(s):

#4456

Summary

This PR introduces 35 new macOS detection rules migrated from endpoint to enable late-stage kill chain detection through SIEM alerting.

Strategic Rationale
This migration follows the Kill Chain & Confidence Model for macOS detection strategy:

Endpoint Rules (BLOCK): Focus on early kill chain stages (Initial Access, Execution, Defense Evasion) where immediate blocking prevents compromise
SIEM Rules (ALERT): Focus on late kill chain stages (Persistence, Discovery, Collection, C2, Lateral Movement) where alerting enables investigation of potentially compromised systems
Rules selected for SIEM migration represent behaviors that:

Occur after initial compromise and require investigation rather than blocking
Have higher false positive potential in endpoint blocking context
Provide threat hunting value through correlation with other signals
Detect post-exploitation activity where blocking would not prevent the initial compromise

@DefSecSentinel DefSecSentinel self-assigned this Jan 30, 2026
@DefSecSentinel DefSecSentinel added OS: macOS Rule: New Proposal for new rule labels Jan 30, 2026
@github-actions
Copy link
Contributor

github-actions bot commented Jan 30, 2026

Rule: New - Guidelines

These guidelines serve as a reminder set of considerations when proposing a new rule.

Documentation and Context

  • Detailed description of the rule.
  • List any new fields required in ECS/data sources.
  • Link related issues or PRs.
  • Include references.

Rule Metadata Checks

  • creation_date matches the date of creation PR initially merged.
  • min_stack_version should support the widest stack versions.
  • name and description should be descriptive and not include typos.
  • query should be inclusive, not overly exclusive, considering performance for diverse environments. Non ecs fields should be added to non-ecs-schema.json if not available in an integration.
  • min_stack_comments and min_stack_version should be included if the rule is only compatible starting from a specific stack version.
  • index pattern should be neither too specific nor too vague, ensuring it accurately matches the relevant data stream (e.g., use logs-endpoint.process-* for process data).
  • integration should align with the index. If the integration is newly introduced, ensure the manifest, schemas, and new_rule.yaml template are updated.
  • setup should include the necessary steps to configure the integration.
  • note should include any additional information (e.g. Triage and analysis investigation guides, timeline templates).
  • tags should be relevant to the threat and align/added to the EXPECTED_RULE_TAGS in the definitions.py file.
  • threat, techniques, and subtechniques should map to ATT&CK always if possible.

New BBR Rules

  • building_block_type should be included if the rule is a building block and the rule should be located in the rules_building_block folder.
  • bypass_bbr_timing should be included if adding custom lookback timing to the rule.

Testing and Validation

  • Provide evidence of testing and detecting the expected threat.
  • Check for existence of coverage to prevent duplication.

@tradebot-elastic
Copy link

tradebot-elastic commented Jan 30, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Security Software Discovery via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Virtual Machine Fingerprinting via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Node (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Python Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Plist Loaded by Launchctl from Unusual Location (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Jan 30, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Security Software Discovery via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Virtual Machine Fingerprinting via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Node (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Python Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Plist Loaded by Launchctl from Unusual Location (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Jan 30, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Plist Loaded by Launchctl from Unusual Location (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Security Software Discovery via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Virtual Machine Fingerprinting via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Python Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Node (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Jan 30, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Plist Loaded by Launchctl from Unusual Location (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Docker Outbound Connection to Suspicious Top Level Domain (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Security Software Discovery via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Virtual Machine Fingerprinting via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Python Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Node (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Jan 30, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Plist Loaded by Launchctl from Unusual Location (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Docker Outbound Connection to Suspicious Top Level Domain (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ macOS Security Software Discovery via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Virtual Machine Fingerprinting via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Python Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Node (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Jan 30, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Docker Outbound Connection to Suspicious Top Level Domain (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ macOS Security Software Discovery via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Virtual Machine Fingerprinting via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Python Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Node (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@DefSecSentinel
fix: add timestamp_override, investigation guides, and fix MITRE mapping
a6f2ed3 
- Added timestamp_override = 'event.ingested' to 15 non-sequence EQL rules
- Added '## Triage and analysis' investigation guides to 19 high-severity rules
- Fixed T1176 technique name from 'Browser Extensions' to 'Software Extensions'
@tradebot-elastic
Copy link

tradebot-elastic commented Jan 30, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Docker Outbound Connection to Suspicious Top Level Domain (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ macOS Security Software Discovery via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Virtual Machine Fingerprinting via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Python Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Node (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@DefSecSentinel
Enhance investigation guides for 19 high-severity macOS SIEM rules
179d6a4 
Enhanced investigation guides to align with existing SIEM rule format:
- Added detailed context paragraphs explaining the threat and detection logic
- Expanded investigation steps to 6-7 items with specific field references
- Enhanced false positive analysis with 4-5 items and exclusion guidance
- Added comprehensive response and remediation steps (6-7 items)

Rules enhanced:
- Defense Evasion: dylib_injection, gatekeeper_override, tcc_access
- Persistence: shell_profile, hidden_plist, chromium_extension, startup_item,
  pkg_install_script, launch_agent_daemon
- Execution: unusual_library_python
- Lateral Movement: jamf_endpoint
- Command and Control: google_calendar_c2, oast_domain, etherhiding,
  curl_from_app, curl_google_script, unsigned_binary
- Collection: pbpaste, sensitive_file_compression
@tradebot-elastic
Copy link

tradebot-elastic commented Jan 31, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Docker Outbound Connection to Suspicious Top Level Domain (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ macOS Security Software Discovery via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Virtual Machine Fingerprinting via Grep (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Python Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Node (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Feb 3, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Security Software Discovery via Grep (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Script Interpreter Connection to Non-Standard Port (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Script Interpreter Connection to Non-Standard Port (eql)
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

Mikaayenson
Mikaayenson reviewed Feb 4, 2026
View reviewed changes
Copy link
Contributor

@Mikaayenson Mikaayenson left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm inclined to agree with the comments. @DefSecSentinel Maybe we can collapse these rules?

For example:
Script Interpreter C2 Connections

  • command_and_control_perl_outbound_network_connection.toml
  • command_and_control_suspicious_outbound_python_network.toml
  • command_and_control_script_interpreter_connection_to_non_standard_port.toml
  • Several others with same pattern

C2 LOLBin to Suspicious Web Service

  • command_and_control_suspicious_curl_to_google_app_script.toml
  • command_and_control_aws_s3_connection_via_script.toml
  • command_and_control_google_calendar_c2_via_script.toml
  • Others targeting curl/wget to specific services

etc.

We can probably optimize a lot here by consolidating. The rules engine calculates the number of rules that can be enabled just by interval and rule execution so we need to be consider how this impacts users that want to enable as many rules as possible.

Fundamentally we try to prevent rule fragmentation. There's some other things we probably should do here like covert from eql to esql, or 3rd party edr support, but that will be much easier to see/test after you optimize this set while we have the opportunity to do so.

Id say move this back to Draft (in GitHub) / In Progress (on the project board) until you can clean up a bit more.

@tradebot-elastic
Copy link

tradebot-elastic commented Feb 4, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Security Software Discovery via Grep (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Script Interpreter Connection to Non-Standard Port (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Script Interpreter Connection to Non-Standard Port (eql)
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

Aegrah
Aegrah approved these changes Feb 4, 2026
View reviewed changes
Copy link
Contributor

@Aegrah Aegrah left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, overall wondering whether we could consolidate some rules into one (esp. because this is DR now, no longer ER), and there a few inconsistencies that need to be fixed (esp. the ones regarding the ESQL rules), but I'll approve as I expect @DefSecSentinel to fix those before merging.

@tradebot-elastic
Copy link

tradebot-elastic commented Feb 4, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Security Software Discovery via Grep (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Script Interpreter Connection to Non-Standard Port (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Script Interpreter Connection to Non-Standard Port (eql)
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@DefSecSentinel
fix: ESQL formatting and wildcard versioning patterns
230a272 
- Add Esql. prefix to computed fields in ESQL rules
- Add KEEP statements to ESQL rules for proper field visibility
- Add perl* wildcard to OAST domain rule for version consistency
- Add ruby* wildcard to Etherhiding C2 rule for version consistency
- Fix regex pattern in TCC rule (perl.*/ruby.* for versioning)
@tradebot-elastic
Copy link

tradebot-elastic commented Feb 4, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Security Software Discovery via Grep (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Script Interpreter Connection to Non-Standard Port (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Script Interpreter Connection to Non-Standard Port (eql)
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@DefSecSentinel
fix: remove duplicate Script Interpreter rule
0855744 
Delete command_and_control_suspicious_outbound_python_network.toml which
is an exact duplicate of command_and_control_script_interpreter_connection_to_non_standard_port.toml
(same rule_id: aa1e007a-2997-4247-b048-dd9344742560)
@tradebot-elastic
Copy link

tradebot-elastic commented Feb 4, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Security Software Discovery via Grep (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Script Interpreter Connection to Non-Standard Port (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

DefSecSentinel and others added 2 commits February 4, 2026 12:43
@DefSecSentinel
fix: add timestamp_override to Pbpaste and Gatekeeper rules
9794c63 
- collection_pbpaste_execution_via_unusual_parent.toml
- defense_evasion_gatekeeper_override_and_execution.toml

EQL/KQL rules require timestamp_override: event.ingested
@DefSecSentinel
Merge branch 'main' into migrate
f7e29b9
@tradebot-elastic
Copy link

tradebot-elastic commented Feb 4, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Security Software Discovery via Grep (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Script Interpreter Connection to Non-Standard Port (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Feb 4, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Security Software Discovery via Grep (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Script Interpreter Connection to Non-Standard Port (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@DefSecSentinel
fix: remove perl from Script Interpreter rule
6dae2c2 
Perl is covered by the broader perl_outbound_network_connection rule which
catches perl → any external IP (not just non-standard ports). Perl network
connections on macOS are rare and inherently suspicious regardless of port.
@tradebot-elastic
Copy link

tradebot-elastic commented Feb 4, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Security Software Discovery via Grep (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Script Interpreter Connection to Non-Standard Port (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Feb 4, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Suspicious AWS S3 Connection via Script Interpreter (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious StartupItem Plist Creation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SIP Check by macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious File Creation via Pkg Install Script (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Executable File Download via Wget (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ External IP Address Discovery via Curl (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ DNS Request for IP Lookup Service via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Network Connection to OAST Domain via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Discovery Command Output Written to Suspicious File (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via Suspicious Launch Agent or Launch Daemon (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Google App Script Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl from macOS Application (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System and Network Configuration Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Gatekeeper Override and Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Security Software Discovery via Grep (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Sensitive File Access followed by Compression (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Curl to Jamf Endpoint (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Script Interpreter Connection to Non-Standard Port (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Unusual Library Load via Python (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Perl Outbound Network Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Google Calendar C2 via Script Interpreter (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Curl Execution via Shell Profile (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Etherhiding C2 via Blockchain Connection (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Pbpaste Execution via Unusual Parent Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Apple Mail Rule Plist Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Full Disk Access Permission Check (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Persistence via a Hidden Plist Filename (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Outbound Network Connection via Unsigned Binary (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Manual Loading of a Suspicious Chromium Extension (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Dylib Injection via Process Environment Variables (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious TCC Access Granted for User Folders (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Aegrah Aegrah Aegrah approved these changes

@terrancedejesus terrancedejesus terrancedejesus approved these changes

@w0rk3r w0rk3r Awaiting requested review from w0rk3r

@Samirbous Samirbous Awaiting requested review from Samirbous

@Mikaayenson Mikaayenson Awaiting requested review from Mikaayenson

Assignees

@DefSecSentinel DefSecSentinel

Labels

backport: auto Domain: Endpoint OS: macOS Rule: New Proposal for new rule

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@DefSecSentinel @tradebot-elastic @Mikaayenson @Samirbous @Aegrah @terrancedejesus