JAMF MDM Execution via CLI

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•25

Detects the execution of the 'jamf' binary with specific commands that could be used by attackers for privilege escalation, bypassing security controls, or modifying system configurations. This includes creating user accounts, managing the JAMF framework, removing MDM profiles, resetting passwords, and setting computer names.