Creating the ExtendedAttributesActivity Custom Analytic - Jamf Protect Evaluation Guide

Jamf Protect Evaluation Guide
Solution
Application
Content Type
Technical Documentation
Utilities & Services
ft:locale
en-US

This custom analytic may be used to report on activity of the xattr binary used to clear all extended attributes or the com.apple.quarantine extended attribute from files. This detection functions by monitoring for usage of the xattr binary with the -c and -d options (with com.apple.quarantine) used to clear all or a target extended attribute from a file.

The com.apple.quarantine extended attribute serves as a critical element to ensure important checks for malicious code are performed. When a file is downloaded via a browser or macOS client, the com.apple.quarantine bit is attached to the file, which triggers both a user confirmation prompt and Gatekeeper scan upon first launch.

Requirements

One or more existing plans in the Jamf Protect web app.

  1. In Jamf Protect, click Analytics > All Analytics.
  2. Click Create Custom Analytic at the top of the screen.
  3. Complete the following fields:
    1. In the Analytic Name field, enter ExtendedAttributesActivity.
    2. In Level, select Level - 0.
    3. In Categories, select Visibility.
    4. In Severity, select Informational.
      Note:

      If you are not sending informational alerts to Jamf Protect, adjust the severity from Informational to Low.

    5. In Sensor Type, select Process Event View.
    6. Click </> Filter Text View. In the text box enter the following.
      $event.type == 1 AND $event.process.signingInfo.appid == "com.apple.xattr" AND $event.process.commandLine MATCHES "xattr\\s+(-[lrsvx]{0,5}\\s+){0,5}((.*\\s+)?-[lrsvx]{0,5}c[lrsvxc]{0,5}(\\s.*)?|-[rsvx]{0,4}d[rsvxd]{0,5}\\s+(-[lrsvxd]{0,5}\\s+){0,5}(\"|\')?com\\.apple\\.quarantine(\"|\')?\\s.+)"
  4. Leave the remaining fields at their default selections.
  5. Click Save and verify that the custom analytic appears under Analytics > All Analytics > Custom.
  6. Click Analytic Sets > Create Analytic Set.
  7. Enter a name and select ExtendedAttributesActivity, then click Save.
  8. In Jamf Protect, click Plans.
  9. Select a plan, then click Edit.
  10. Select the analytic set that contains the ExtendedAttributesActivity analytic, then click Save to deploy.