Screensaver Plist File Modified by Unexpected Process

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Screensaver Plist File Modified by Unexpected Process

Identifies when a screensaver plist file is modified by an unexpected process. An adversary can maintain persistence on a macOS endpoint by creating a malicious screensaver (.saver) file and configuring the screensaver plist file to execute code each time the screensaver is activated.

Rule type: eql

Rule indices:

logs-endpoint.events.file*

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

Domain: Endpoint
OS: macOS
Use Case: Threat Detection
Tactic: Persistence
Data Source: Elastic Defend
Resources: Investigation Guide
Noise: Low
Performance: Normal
Rule Type: Event Correlation (EQL)
Platform: macOS

Version: 115

Rule authors:

Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Disclaimer: This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

Investigating Screensaver Plist File Modified by Unexpected Process

The com.apple.screensaver.*.plist files define the active screensaver module and its settings. Adversaries can drop a malicious .saver bundle and update these plist files so that the bundle is loaded and executes code every time the screensaver activates. This rule alerts when a screensaver plist file is modified by an unsigned or untrusted process, or by a script interpreter or native utility commonly abused by attackers.

Possible investigation steps

Identify the process that modified the plist (process.executable, process.code_signature.*) and determine why an untrusted process or interpreter changed screensaver settings. Review the process’s execution event for its command line and parent.
Review the plist file (file.path) and its current contents on the host to identify the configured screensaver module and its path.
Locate the referenced .saver bundle and check its code signature, creation time, origin, and contents.
Review recent file events for .saver bundles written to ~/Library/Screen Savers/, /Library/Screen Savers/, or unusual locations around the time of the alert.
Analyze the process tree of the modifying process for signs of initial access or execution, such as downloads, script interpreters, or other persistence activity.
Check for child processes of ScreenSaverEngine or legacyScreenSaver on the host after the modification, which may indicate the payload has already executed.

False positive analysis

Device management solutions or administrative scripts may configure screensaver settings with script interpreters. Verify the script and its origin with the team responsible for endpoint management.
Unsigned or ad hoc signed third-party utilities may change screensaver preferences. Confirm the tool is approved in the environment.
When the activity is confirmed benign, create an exception for the specific process executable or script rather than for the plist file path.

Response and remediation

Isolate the affected host from the network if the modification is determined to be malicious.
Revert the screensaver plist to a known good configuration and remove any malicious .saver bundle after preserving a copy for analysis.
Terminate the modifying process and any processes started by the malicious screensaver.
Investigate how the attacker gained access to the host and remediate the initial access vector.
Escalate to the incident response team and search for the same plist modification or .saver bundle on other macOS hosts.

Setup

edit

Setup

This rule requires data coming in from Elastic Defend.

Elastic Defend Integration Setup

Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

Prerequisite Requirements:

Fleet is required for Elastic Defend.
To configure Fleet Server refer to the documentation.

The following steps should be executed in order to add the Elastic Defend integration on a macOS System:

Go to the Kibana home page and click "Add integrations".
In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
Click "Add Elastic Defend".
Configure the integration name and optionally add a description.
Select the type of environment you want to protect, for MacOS it is recommended to select "Traditional Endpoints".
Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. Helper guide.
We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the helper guide.
Click "Save and Continue".
To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the helper guide.

Rule query

edit

file where host.os.type == "macos" and event.action == "modification" and
  file.name like~ "com.apple.screensaver.*.plist" and
   file.path like (
      "/Users/*/Library/Preferences/ByHost/*",
      "/Library/Managed Preferences/*",
      "/System/Library/Preferences/*"
      ) and
  (
    process.code_signature.trusted == false or
    process.code_signature.exists == false or

    /* common script interpreters and abused native macOS bins */
    process.name like~ (
      "curl",
      "mktemp",
      "tail",
      "funzip",
      "python*",
      "osascript",
      "perl"
      )
   ) and

  /* Filter OS processes modifying screensaver plist files */
  not process.executable like (
    "/usr/sbin/cfprefsd",
    "/usr/libexec/xpcproxy",
    "/System/Library/CoreServices/ManagedClient.app/Contents/Resources/MCXCompositor",
    "/System/Library/CoreServices/ManagedClient.app/Contents/MacOS/ManagedClient"
    )

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Persistence
- ID: TA0003
- Reference URL: https://attack.mitre.org/tactics/TA0003/
Technique:
- Name: Event Triggered Execution
- ID: T1546
- Reference URL: https://attack.mitre.org/techniques/T1546/
Sub-technique:
- Name: Screensaver
- ID: T1546.002
- Reference URL: https://attack.mitre.org/techniques/T1546/002/

« Unexpected Child Process of macOS Screensaver Engine Persistence via Suspicious Launch Agent or Launch Daemon »