Testing and Analyzing Jamf Protect Analytics: DisguisedExecutable

Jamf Trusted Access Solution Guide for Business
Solution
Application
Content Type
Technical Documentation
Solution Guide
Utilities & Services
ft:locale
en-US

Requirements

If using a virtual machine, take a snapshot to revert back to at the end of this simulation.

  1. Open Terminal and run these commands in the provided order.
    # copy the native whoami binary to create an executable disguised as a PDF
cp /usr/bin/whoami ~/Desktop/jptest.pdf
  2. Navigate to your desktop, locate the newly created jptest.pdf file. Note the Preview icon indicating this is a PDF file.
  3. Open Terminal and run the following command.
    ~/Desktop/jptest.pdf
    After completing the above testing steps a new alert titled DisguisedExecution can be expected inside Jamf Protect Cloud.
  4. Open and review the DisguisedExecution alert. The most interesting data points when analyzing this alert are:

    • Summary > Name: The name of the suspicious LaunchDaemon/Agent that was created.

    • Summary > itemBinary: The file path for the persisted item that will be executed at system startup. This is the most useful file to investigate in responding to this incident.

    • Processes > Process Tree: The binaries and their code signing information for each process leading to the event.

    In a real world scenario, investigation of this alert would begin with examining the contents and purpose of the file being persisted by the LaunchDaemon/Agent (provided as the itemBinary) as well as the method of creation of the LaunchDaemon/Agent itself.

  5. If a virtual machine snapshot was taken prior to completing this test scenario the easiest cleanup method is to revert to the snapshot. Otherwise run these commands in Terminal to remove the test files created.
    # delete the executable disguised as a PDF
rm ~/Desktop/jptest.pdf
# delete the testing file
rm /Users/Shared/jptest