JAMF MDM Potential Suspicious Child Process

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•30

Detects potential suspicious child processes of "jamf". This could indicate the abuse of Jamf as a C2 server, as observed with the Typhon MythicAgent. Specifically, the rule looks for '/bash' or '/sh' being spawned as child processes of the 'jamf' executable.