KQL Search

Query Details

HomeAI ToolsDevice Query

Credential Access Builtin

Query

tags:

Query:
DeviceProcessEvents
| where FileName has_any ("defaults","mkpassdb") and ProcessCommandLine has_any ("ShadowHashData", "dump")
References:
https://github.com/elastic/detection-rules/blob/e9baebc2bc18f90ae16501613cd9521a16a38ad7/rules/macos/credential_access_dumping_hashes_bi_cmds.toml

Explanation

This KQL (Kusto Query Language) query is designed to search for specific suspicious activities in device process events. Here's a simple summary:

  • The query looks at events related to processes running on devices (DeviceProcessEvents).
  • It filters these events to find processes where the file name contains either "defaults" or "mkpassdb".
  • Additionally, it checks if the command line used to run these processes contains either "ShadowHashData" or "dump".

In essence, the query is trying to identify potential credential dumping activities on macOS devices by looking for specific process names and command line arguments that are commonly associated with such malicious behavior.

Details

Ali Hussein profile picture

Ali Hussein

Released: October 28, 2023

Tables

DeviceProcessEvents

Keywords

Devices

Operators

DeviceProcessEvents|wherehas_any

Actions