OSX/Leverage.A

Hunt Hypothesis

This detection targets the specific adversary behavior of OSX/Leverage.A, which involves malicious activity on macOS systems that may indicate early-stage compromise or reconnaissance efforts. Proactively hunting for this signal in Azure Sentinel is critical to identify potential lateral movement vectors and validate endpoint security configurations before low-severity indicators escalate into significant incidents.

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 7 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the OSX/Leverage.A detection rule in an enterprise macOS environment, along with recommended filters and exclusions:

• Automated Software Deployment via MDM (Jamf/Intune)

  • Scenario: The rule triggers when a Mobile Device Management (MDM) solution like Jamf Pro or Microsoft Intune pushes a software update or configuration profile. These tools often execute commands with elevated privileges (sudo) that modify system binaries or launch background agents, mimicking the behavior of an attacker leveraging legitimate processes to establish persistence.
  • Filter/Exclusion: Exclude processes where the parent process is jamf (or com.jamfsoftware.jamf.agent) and the execution path resides within /usr/local/bin/jamf/. Additionally, filter out events occurring during defined maintenance windows (e.g., 02:00–04:00 UTC) where bulk deployments are scheduled.

• Scheduled System Maintenance via cron or launchd

  • Scenario: Legitimate system administration tasks run by the root user via LaunchAgents (/Library/LaunchAgents) or Cron jobs. A common trigger is a nightly backup script (e.g., using Carbon Copy Cloner or Time Machine) that invokes rsync or custom shell scripts to archive data, which may involve creating new executables or modifying permissions in a way the rule flags as suspicious leverage.
  • Filter/Exclusion: Create an exclusion for processes initiated by launchd (PID 1) where the executable path matches known enterprise maintenance tools like /usr/local/bin/ccclauncher or scripts located in /Library/LaunchDaemons. Whitelist specific command-line arguments associated with backup routines.

• Endpoint Security Agent Self-Updates *