Rule Info
Name
JAMF MDM Execution
Author
Jay Pandit
Description
Detects execution of the "jamf" binary to create user accounts and run commands. For example, the binary can be abused by attackers on the system in order to bypass security controls or remove application control polices.
Reference
Date
2023-08-22 00:00:00
Modified
None
Id
be2e3a5c-9cc7-4d02-842a-68e9cb26ec49
Tags
attack.execution
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
Nasreddine Bencherchali
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12
github-actions[bot]
Merge PR #4891 from @nasbench - Promote older rules status from `experimental` to `test`
2024-07-01
Scan your endpoints, forensic images or collected files with our portable scanner THOR