jamf_protectinformationalTTP

Airdrop Inbound

A file has been created by the sharingd service.

Detection Query

$event.type == 3 AND $event.prevFile BEGINSWITH "/private/var/folders/" AND NOT $event.path MATCHES "(/Users/[^/]+/Library/Sharing/|/var/folders/).*" AND $event.process.signingInfo.appid == "com.apple.sharingd"

Author

Jamf

Data Sources

File System EventsmacOS Endpoint Security

Platforms

macos

Tags

Visibility

Raw Content

---
name: AirdropInbound
uuid: f0d7d630-c9a0-4ecf-ad8f-d91a83ce07b2
longDescription: A file has been created by the sharingd service.
level: 0
inputType: GPFSEvent
tags: null
snapshotFiles: []
filter: $event.type == 3 AND $event.prevFile BEGINSWITH "/private/var/folders/"
  AND NOT $event.path MATCHES "(/Users/[^/]+/Library/Sharing/|/var/folders/).*"
  AND $event.process.signingInfo.appid == "com.apple.sharingd"
actions:
  - name: Log
context: []
categories:
  - Visibility
version: 1
severity: Informational
shortDescription: Airdrop Event Inbound
label: Airdrop Inbound
remediation: null
MitreCategories:
  - Visibility