EXPLORE DETECTIONS
USB Insertion Non Writable
This detection functions by monitoring for removable device insertion events where the device hardware is determined to be removable and non-writable.
User Created by DSCL
This detection functions by monitoring for processes created with a binary carrying the com.apple.dscl identifier and have a process argument containing the '-create' argument used to create a user.
User Deleted by DSCL
This detection functions by monitoring for processes deleted with a binary carrying the com.apple.dscl identifier and have a process argument containing the '-delete' argument used to delete a user.
User Privilege Escalation by dseditgroup and Self Service
This detection functions by monitoring for process creation with a binary carrying the signing information of 'com.apple.dseditgroup', a command-line argument of '-o edit -a' (required to escalate privileges with this binary) and with the parent process originating from the Jamf Pro management framework's application support directory.
User Switched on Commandline
This detection functions by monitoring for usage of the xattr binary with the -c and -d args (with com.apple.quarantine) used to clear all or a target extended attribute from a file.
User Switched on Commandline
This detection functions by monitoring for su processes created that have an associated TTY and are determined to be created through a fully interactive shell, such as those from a Terminal session.
Web App Created
This detection functions by monitoring and report when Web Apps are being created by Safari in the Applications directory in a users home folder.
Zshenv Created or Modified
This detection functions by monitoring for the creation of new new file or modification of a .zshenv in the User's profile.