Implementing Behavioral Baselines in Security Monitoring

Given the diversity of endpoints and the range of users within an organisation, the system and user behaviours observed on these endpoints can significantly vary. While endpoints are typically managed through a Mobile Device Management (MDM) solution, there is also the distribution of organisational software and system activities related to device management to consider.

What are behavioural baselines?

The concept of behavioural baselines leverages endpoint security solutions to go beyond merely identifying known threats or malicious activities linked to recognized malware. It involves setting standards for the types of activities that should be expected on endpoints, focusing specifically on those initiated by known or trusted processes.

Endpoints are inherently equipped with various binaries and tools intended for use by IT administrators or authorized software. However, adversaries can also exploit these to execute arbitrary and malicious code.

The primary objective is to detect and analyse the usage of specific binaries or tools when they are utilized in unauthorised or illegitimate ways across endpoints. This approach aims to refine our security measures by differentiating between normal and potentially malicious activities, enhancing our overall defensive strategy.

While IT and security teams often try to collaborate, the depth of their partnership is not always as comprehensive as it should be. Security teams diligently monitor threats and anomalies across the device fleet but may lack a thorough understanding of the tooling and activities employed by IT teams for device management and security.

For a more effective approach, both teams should work closely together, ensuring transparency regarding the tools used and the activities undertaken by IT teams. Similarly, security teams should offer insights into the types of behaviours they are monitoring.

Only through such cooperation can we progress toward establishing robust behavioral baselines. This partnership is crucial for identifying suspicious activities early and maintaining the security and integrity of the organisation’s digital environment.

In a previous article we’ve covered how to achieve tailored event monitoring on macOS and explained the techniques which we’ll be using in this article as well.

You can find the previous article here: Tailored event monitoring on macOS

To effectively distinguish between legitimate behavior and potentially suspicious activity, it's important to have a comprehensive understanding of the activity occurring on the endpoints within an organisation. 

This involves conducting a thorough inventory of the tools and utilities employed across the organisation. For example, this inventory would include software used by various departments for daily operations, administrative tools utilised by IT teams for system maintenance, and security tools deployed to protect against and monitor for threats. By cataloging these tools and understanding their normal usage patterns, we can establish a baseline of expected and suspicious activities.

As example

As the macOS platform becomes an increasingly popular target for malware authors and adversaries, it's crucial to have robust detection mechanisms in place. These mechanisms are essential for identifying suspicious activities that could indicate the initial stages of an attack. Common techniques such as Credential Access or Reconnaissance are often employed in Infostealers or several other types of malware.

Taking the example of user notifications created using osascript, let's break down the steps necessary to detect potentially malicious activity:

By focusing on these aspects, IT and security teams can enhance their ability to detect and respond to early indicators of malicious activity, specifically those utilising legitimate tools like osascript for malicious purposes.

In the following video, we will demonstrate a Swift macOS application that invokes AppleScript to display a notification, which is then used to capture the user's password.

And once such behavior has been detected an Alert will be generated in Jamf Protect containing relevant data about the activity.

As highlighted previously, one notable example involves the use of binaries such as system_profiler, sysctl, or ioreg to gather hardware or software information. This could include collecting device identifiers like serial numbers, unique UUIDs, or determining whether the endpoint is a physical device or a virtual machine.

While legitimate applications often execute these binaries to access specific data not readily available when programming in Swift, adversaries might also exploit these tools to extract particular information for malicious purposes.

For instance, an adversary might use the obtained data in the following ways:

This nuanced approach by adversaries underscores the importance of closely monitoring the use of system binaries that can reveal critical information about endpoints.

Imagine we're keen on tracking usage of the system_profiler command, particularly when it's used with the SPHardwareDataType argument. 

Executing this command reveals detailed information about the device's hardware, such as:

As previously noted, it's common for legitimate software to utilise the system_profiler command to access specific information about the system. This is an important factor to consider in building an detection to ensure we can distinguish between normal, expected use and potential malicious activity.

Detecting the execution of system_profiler with specific arguments by software not signed by Apple or with a valid Developer signing certificate can be accomplished through the implementation of a custom analytic, as outlined below:

$event.process.signingInfo.appid == "com.apple.system_profiler" AND
$event.type  == 1 AND NOT
$event.process.responsible.signingInfo.signerType IN {0, 1, 2} AND
(ANY $event.process.args == "SPHardwareDataType")

Breaking down the provided analytic condition, we're applying a series of filters to hone in on specific events that might indicate unauthorized use of system_profiler with potentially malicious intent:

Going forward, the plan involves assembling a detailed inventory of trusted corporate tools. Optionally, employing Jamf Pro for its Software Inventory collection, alongside Jamf Protect's Telemetry feature to monitor all process executions, provides a solid foundation for beginning the development of behavioral baselines.

This will be accomplished by leveraging the examples previously discussed, in addition to exploring further examples available in our open-source repository.