What does APT Activity Look Like on MacOS?
Tags
cmtmf-attack-pattern: Boot Or Logon Autostart Execution Command And Scripting Interpreter
attack-pattern: Direct Application Versioning - T1661 Bash History - T1552.003 Boot Or Logon Autostart Execution - T1547 Command And Scripting Interpreter - T1623 Dns - T1071.004 Dns - T1590.002 File And Directory Permissions Modification - T1222 Indicator Removal On Host - T1630 Ip Addresses - T1590.005 Launch Daemon - T1543.004 Launchctl - T1569.001 Malware - T1587.001 Malware - T1588.001 Network Service Scanning - T1423 System Information Discovery - T1426 Server - T1583.004 Server - T1584.004 Software - T1592.002 Ssh - T1021.004 Timestomp - T1070.006 Bash History - T1139 Command-Line Interface - T1059 Indicator Removal On Host - T1070 Launch Daemon - T1160 Launchctl - T1152 Network Service Scanning - T1046 Remote Services - T1021 Remote System Discovery - T1018 Sudo - T1169 System Information Discovery - T1082 Valid Accounts - T1078 Timestomp - T1099 Indicator Removal On Host Network Service Scanning Remote System Discovery Valid Accounts
Show in Graph
Common Information
Type Value
UUID c5632396-a28c-4958-99c1-ba7ecf34b47b
Fingerprint 26ad991e2d078385
Analysis status DONE
Considered CTI value 0
Text language
Published Nov. 14, 2021, 5:38 a.m.
Added to db Sept. 26, 2022, 9:31 a.m.
Last updated Nov. 12, 2024, 11:51 a.m.
Headline What does APT Activity Look Like on MacOS?
Title What does APT Activity Look Like on MacOS?
Detected Hints/Tags/Attributes 95/2/17
Source URLs
Redirection Url
Details Source https://themittenmac.com/what-does-apt-activity-look-like-on-macos/
URL Provider
Details Provider Source level domain
Details themittenmac.com themittenmac.com
Attributes
Details Type #Events CTI Value
Details Domain 1 
cyber-peace.com
Details Domain 359 
com.apple
Details File 88 
1.txt
Details File 5 
5.txt
Details File 1 
xsprinter.pl
Details File 2 
ssh.pl
Details File 24 
apple.log
Details File 10 
inwindow.pl
Details IPv4 1 
61.78.62.21
Details Url 1 
http://61.78.62.21:8080/tssd
Details Url 1 
http://61.78.62.21:8080/tss
Details Url 1 
http://61.78.62.21:8080/grrs
Details Url 1 
http://61.78.62.21:8080/1.txt
Details Url 1 
http://61.78.62.21:8080/5.txt
Details Url 1 
http://61.78.62.21:8080/5.txt|bash
Details Url 1 
http://61.78.62.21:8080/x
Details Url 1 
http://61.78.62.21:8080/rs