Potential Discovery Activity Using Find Command on MacOS

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•2•0•33

Detects the usage of the 'find' command on macOS with specific permission-related arguments. These arguments are often used by attackers during discovery phases to locate files with unusual permissions, such as SUID/SGID binaries or world-writable files, which could indicate potential privilege escalation vectors or misconfigurations.