Testing and Analyzing PlistDisguisedAsApple - Jamf Protect Evaluation Guide

Jamf Protect Evaluation Guide
Solution
Application
Content Type
Technical Documentation
Utilities & Services
ft:locale
en-US

Complete these steps to generate a suspicious LaunchAgent and test the PlistDisguisedAsApple analytic.

Requirements

If using a virtual machine, take a snapshot to revert back to at the end of this simulation.

  1. Open Terminal and run these commands in the provided order.
    # create a testing file to be persisted
touch /Users/Shared/jptest
    
# create the LaunchAgents directory if needed
mkdir -p ~/Library/LaunchAgents
    
# create the suspicious LaunchAgent
echo "<?xml version="1.0" encoding="UTF-8"?>     
<plist version="1.0">
<dict>
        <key>Label</key>
        <string>com.apple.jptest</string>
        <key>ProgramArguments</key>
        <array>
            <string>/Users/Shared/jptest</string>
        </array>
        <key>RunAtLoad</key>
        <true/></dict>
</plist>" > ~/Library/LaunchAgents/com.apple.jptest.plist
    After completing the testing steps, a new alert titled PlistDisguisedAsApple is available within Jamf Protect Cloud.
  2. Open and review the PlistDisguisedAsApple alert. The most interesting data points when analyzing this Alert are:

    • Summary > Name: The name of the suspicious LaunchDaemon/Agent that was created.

    • Summary > itemBinary: The file path for the persisted item that will be executed at system startup. This is the most useful file to investigate in responding to this incident.

    • Processes > Process Tree: The binaries and their code signing information for each process leading to the event.

    In a real world scenario, investigation of this alert would begin with examining the contents and purpose of the file being persisted by the LaunchDaemon/Agent (provided as the itemBinary) as well as the method of creation of the LaunchDaemon/Agent itself.

  3. If a virtual machine snapshot was taken prior to completing this test scenario the easiest cleanup method is to revert to the snapshot. Otherwise run these commands in Terminal to remove the test files created.
    # delete the suspicious LaunchAgent
rm ~/Library/LaunchAgents/com.apple.jptest.plist
    
# delete the testing file
rm /Users/Shared/jptest