Detections

title: macOS Gaslight Persistence via Masqueraded LaunchAgent
description: Detects LaunchAgent persistence creation mimicking Apple system services label com.apple.system.services.activity.
logsource:
  product: macos
  category: file_event
detection:
  selection:
    file.path: "*com.apple.system.services.activity.plist"
  condition: selection
level: high
tags:
  - attack.persistence
  - attack.t1543.001
references:
  - https://www.sentinelone.com/labs/macos-gaslight-rust-backdoor-turns-prompt-injection-on-the-analyst-not-the-sandbox/

rule macOS_Gaslight_Backdoor {
  strings:
    $s1 = "com.apple.system.services.activity" ascii wide nocase
    $s2 = "file/token:redacted" ascii wide
    $s3 = "{{DATA}}" ascii wide
    $s4 = "init_python_enable" ascii wide
  condition:
    2 of them
}