Event Triggered Execution: Emond `T1546.014`

Tactics: Privilege Escalation, Persistence

Adversaries may gain persistence and elevate privileges by executing malicious content triggered by the Event Monitor Daemon (emond). Emond is a Launch Daemon that accepts events from various services, runs them through a simple rules engine, and takes action. The emond binary at /sbin/emond will load any rules from the /etc/emond.d/rules/ directory and take action once an explicitly defined event takes place.

Events covered

2 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
ESF	create	File or Directory Create
ESF	write	File Write

Authoring guide

These 4 rules share fields, values, and exclusions.

Fields filtered most (6 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`TargetFilename`	2	`contains` 1, `ends_with` 1, `wildcard` 1	`.plist`, `/etc/emond.d/rules/`, `/etc/emond.d/rules/.plist`, `/private/etc/emond.d/rules/.plist`, `/private/var/db/emondclients/`
`event.type`	2	`eq` 1, `in` 1	`start`, `process_started`
`host.os.type`	2	`eq` 2
`parent_process_name`	2	`eq` 2	`emond`
`process_name`	2	`wildcard` 2	`base64`, `bash`, `cp`
`EventType`	1	`eq` 1	`modification`

Top indicator values (37 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`parent_process_name`	`eq`	`emond` elasticPotential Persistence via Emond elasticSuspicious Emond Child Process	2	2
`process_name`	`wildcard`	`base64` elasticPotential Persistence via Emond elasticSuspicious Emond Child Process	2	5
`process_name`	`wildcard`	`bash` elasticPotential Persistence via Emond elasticSuspicious Emond Child Process	2	39
`process_name`	`wildcard`	`cp` elasticPotential Persistence via Emond elasticSuspicious Emond Child Process	2	3
`process_name`	`wildcard`	`csh` elasticPotential Persistence via Emond elasticSuspicious Emond Child Process	2	18
`process_name`	`wildcard`	`curl` elasticPotential Persistence via Emond elasticSuspicious Emond Child Process	2	32
`process_name`	`wildcard`	`dash` elasticPotential Persistence via Emond elasticSuspicious Emond Child Process	2	22
`process_name`	`wildcard`	`echo` elasticPotential Persistence via Emond elasticSuspicious Emond Child Process	2	3
`process_name`	`wildcard`	`fish` elasticPotential Persistence via Emond elasticSuspicious Emond Child Process	2	19
`process_name`	`wildcard`	`ksh` elasticPotential Persistence via Emond elasticSuspicious Emond Child Process	2	22
`process_name`	`wildcard`	`launchctl` elasticPotential Persistence via Emond elasticSuspicious Emond Child Process	2	2
`process_name`	`wildcard`	`mv` elasticPotential Persistence via Emond elasticSuspicious Emond Child Process	2	4
`process_name`	`wildcard`	`osascript` elasticPotential Persistence via Emond elasticSuspicious Emond Child Process	2	33
`process_name`	`wildcard`	`perl*` elasticPotential Persistence via Emond elasticSuspicious Emond Child Process	2	37
`process_name`	`wildcard`	`php*` elasticPotential Persistence via Emond elasticSuspicious Emond Child Process	2	41
`process_name`	`wildcard`	`pwsh` elasticPotential Persistence via Emond elasticSuspicious Emond Child Process	2	6
`process_name`	`wildcard`	`python` elasticPotential Persistence via Emond elasticSuspicious Emond Child Process	2	2
`process_name`	`wildcard`	`python*` elasticPotential Persistence via Emond elasticSuspicious Emond Child Process	2	71
`process_name`	`wildcard`	`sh` elasticPotential Persistence via Emond elasticSuspicious Emond Child Process	2	39
`process_name`	`wildcard`	`tcsh` elasticPotential Persistence via Emond elasticSuspicious Emond Child Process	2	22
`process_name`	`wildcard`	`touch` elasticPotential Persistence via Emond elasticSuspicious Emond Child Process	2	4
`process_name`	`wildcard`	`wget` elasticPotential Persistence via Emond elasticSuspicious Emond Child Process	2	20
`process_name`	`wildcard`	`zsh` elasticPotential Persistence via Emond elasticSuspicious Emond Child Process	2	37
`EventType`	`eq`	`modification` elasticEmond Rules Creation or Modification	1	72
`TargetFilename`	`contains`	`/etc/emond.d/rules/` sigmaMacOS Emond Launch Daemon	1
`TargetFilename`	`contains`	`/private/var/db/emondclients/` sigmaMacOS Emond Launch Daemon	1
`TargetFilename`	`ends_with`	`.plist` sigmaMacOS Emond Launch Daemon	1	3
`TargetFilename`	`wildcard`	`/etc/emond.d/rules/*.plist` elasticEmond Rules Creation or Modification	1
`TargetFilename`	`wildcard`	`/private/etc/emond.d/rules/*.plist` elasticEmond Rules Creation or Modification	1
`TargetFilename`	`wildcard`	`/private/var/db/emondclients/*` elasticEmond Rules Creation or Modification	1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: macOS

Domain: Endpoint

Sigma 1 rule

MacOS Emond Launch Daemon

Event Triggered Execution: Emond T1546.014