Add XProtect definitions for macOS

Velocidex · Feb 9, 2024 · cb64985 · cb64985
1 parent cd440b2
commit cb64985
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 1 deletion.
diff --git a/definitions/MacOS_XProtect_Detections.yaml b/definitions/MacOS_XProtect_Detections.yaml
@@ -27,6 +27,10 @@ Sources:
 - VQL: |
     SELECT *
     FROM Rows
+    WHERE dt > DateAfter
+      AND dt < DateBefore
+      AND (violated_rule, exec_path, responsible_path, responsible_signing_id,
+        exec_cdhash, exec_sha256, responsible_cdhash, responsible_sha256 ) =~ FilterRegex
 
   SQL: |
     SELECT * FROM events