Testing and Analyzing Jamf Protect Analytics: ExtendedAttributesActivity - Jamf Protect Evaluation Guide

Jamf Protect Evaluation Guide
Solution
Application
Content Type
Technical Documentation
Utilities & Services
ft:locale
en-US

Complete these steps to test the ExtendedAttributesActivity custom analytic.

Requirements

If using a virtual machine, take a snapshot to revert back to at the end of this simulation.

  1. Using Safari, download a file from the internet.
  2. Open Terminal and run the following command.
    xattr -d com.apple.quarantine <path to downloaded file>
  3. Open the file in Finder or launch the file from Terminal.
  4. Open and review the ExtendedAttributesActivity alert. The most interesting data points when analyzing this Alert are:

    • Summary > Process Event Details > Process Arguments: Provides the argument that was executed including the extended attribute that was modified and the filename.

    • Processes: The process tree provides indication of how the xattr binary was initiated.

    • Users: Provides indication of who initiated the argument.

    In a real world scenario, investigation of this alert should begin with examining the process arguments to identify which file was being modified and what extended attributes were being modified.

  5. If a virtual machine snapshot was taken prior to completing this test scenario the easiest cleanup method is to revert to the snapshot.