jamf_protectinformationalTTP

DNS Service Discovery

This detection functions by monitoring for process creation involving a binary carrying the signing information of 'com.apple.dns-sd' and a process argument matches ".*-B\\s\\_\\w.*?\\.\\_tcp".

Detection Query

$event.type == 1 AND $event.process.signingInfo.appid == "com.apple.dns-sd" AND $event.process.commandLine MATCHES ".*-B\\s\\_\\w.*?\\.\\_tcp"

Author

Jamf

Data Sources

Process EventsmacOS Endpoint Security

Platforms

macos

Tags

Visibility

Raw Content

---
name: DnsServiceDiscovery
uuid: e209bb63-f433-48b4-a267-0906acee976a
longDescription: This detection functions by monitoring for process creation involving a binary carrying the signing information of 'com.apple.dns-sd' and a process argument matches ".*-B\\s\\_\\w.*?\\.\\_tcp".
level: 0
inputType: GPProcessEvent
tags:
snapshotFiles: []
filter: $event.type == 1 AND
  $event.process.signingInfo.appid == "com.apple.dns-sd" AND
  $event.process.commandLine MATCHES ".*-B\\s\\_\\w.*?\\.\\_tcp"
actions:
  - name: Log
context: []
categories:
  - Visibility
version: 1
severity: Informational
shortDescription: DNS Service Discovery detected
label: DNS Service Discovery
remediation: null
MitreCategories:
  - Visibility