[[ fm.text ]] Click here

macOS Screen Sharing Root Post-Exploitation - STRICT

SIGMA detection rule by Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a · Unknown

Alerts when macOS process telemetry shows one of two high-confidence post-exploitation patterns: a Screen Sharing file-transfer helper running with root identity, or a root cryptocurrency miner identified by its binary or mining arguments and linked to Screen Sharing, launchd, or a temporary or shared path. This is consistent with activity reported after CVE-2026-65400 exploitation and indicates probable unauthorized root-level execution, but authorized security testing or mining research can match. SOC L1 should verify the parent process, user or numeric user identifier, command line, executable path, affected Mac, and nearby Screen Sharing network activity, then escalate if the activity is not explicitly authorized. Déclenche une alerte lorsque la télémétrie des processus macOS montre l’un des deux schémas de post-exploitation à haute confiance : un outil de transfert de fichiers Screen Sharing exécuté avec l’identité root, ou un mineur de cryptomonnaie exécuté en root, identifié par son binaire ou ses arguments de minage et lié à Screen Sharing, à launchd ou à un chemin temporaire ou partagé. Ce comportement est compatible avec l’activité signalée après l’exploitation de la CVE-2026-65400 et indique une exécution non autorisée probable avec les privilèges root, mais des tests de sécurité ou des recherches sur le minage autorisés peuvent correspondre. Le SOC L1 doit vérifier le processus parent, l’utilisateur ou l’identifiant utilisateur numérique, la ligne de commande, le chemin de l’exécutable, le Mac concerné et l’activité réseau Screen Sharing proche, puis escalader si l’activité n’est pas explicitement autorisée.

title: macOS Screen Sharing Root Post-Exploitation - STRICT
id: 8b58c9c1-8d36-4a0d-8ab0-5a0e46f4c1c8
status: experimental
description: |
  Alerts when macOS process telemetry shows one of two high-confidence post-exploitation patterns: a Screen Sharing file-transfer helper running with root identity, or a root cryptocurrency miner identified by its binary or mining arguments and linked to Screen Sharing, launchd, or a temporary or shared path. This is consistent with activity reported after CVE-2026-65400 exploitation and indicates probable unauthorized root-level execution, but authorized security testing or mining research can match. SOC L1 should verify the parent process, user or numeric user identifier, command line, executable path, affected Mac, and nearby Screen Sharing network activity, then escalate if the activity is not explicitly authorized.
  Déclenche une alerte lorsque la télémétrie des processus macOS montre l’un des deux schémas de post-exploitation à haute confiance : un outil de transfert de fichiers Screen Sharing exécuté avec l’identité root, ou un mineur de cryptomonnaie exécuté en root, identifié par son binaire ou ses arguments de minage et lié à Screen Sharing, à launchd ou à un chemin temporaire ou partagé. Ce comportement est compatible avec l’activité signalée après l’exploitation de la CVE-2026-65400 et indique une exécution non autorisée probable avec les privilèges root, mais des tests de sécurité ou des recherches sur le minage autorisés peuvent correspondre. Le SOC L1 doit vérifier le processus parent, l’utilisateur ou l’identifiant utilisateur numérique, la ligne de commande, le chemin de l’exécutable, le Mac concerné et l’activité réseau Screen Sharing proche, puis escalader si l’activité n’est pas explicitement autorisée.
references:
  - https://support.apple.com/en-us/148170
  - https://advisories.ncsc.nl/2026/ncsc-2026-0267.html
  - https://www.f5.com/labs/articles/weekly-threat-bulletin-august-12th-2026
author: Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a
date: 2026-08-19
related:
  - id: b9a6e4dc-17f1-4e68-92b9-15db8274cdd1
    type: derived
logsource:
  product: macos
  category: process_creation
detection:
  selection_transfer_parent:
    ParentImage|endswith:
      - /screensharingd
      - /RemoteManagement/screensharingd.bundle/Contents/MacOS/screensharingd
  selection_transfer_child:
    Image|endswith:
      - /SSFileCopySender
      - /SSFileCopyReceiver
  selection_transfer_root_arguments:
    CommandLine|contains:
      - ' 0 80'
      - ' uid=0 '
      - ' uid:0 '
      - ' --uid 0 '
      - ' --user-id 0 '
      - ' gid=80 '
      - ' gid:80 '
      - ' --gid 80 '
  selection_transfer_root_identity:
    User:
      - root
      - _root
  selection_transfer_root_uid:
    UserId: 0
  selection_transfer_root_effective_uid:
    EffectiveUserId: 0
  selection_transfer_root_gid:
    GroupId: 80
  selection_miner_root_user:
    User:
      - root
      - _root
  selection_miner_root_uid:
    UserId: 0
  selection_miner_root_effective_uid:
    EffectiveUserId: 0
  selection_miner_name:
    Image|endswith:
      - /xmrig
      - /minerd
      - /cpuminer
      - /xmr-stak
  selection_miner_cli:
    CommandLine|contains:
      - stratum+tcp
      - stratum+ssl
      - --donate-level
      - cryptonight
      - randomx
  selection_miner_remote_parent:
    ParentImage|endswith:
      - /screensharingd
      - /ARDAgent
  selection_miner_suspicious_path:
    Image|startswith:
      - /tmp/
      - /private/tmp/
      - /var/tmp/
      - /Users/Shared/
  selection_miner_launchd_parent:
    ParentImage|endswith: /launchd
  condition: (selection_transfer_parent and selection_transfer_child and (selection_transfer_root_arguments or 1 of selection_transfer_root_*)) or (1 of selection_miner_root_* and (selection_miner_name or selection_miner_cli) and (selection_miner_remote_parent or selection_miner_suspicious_path or selection_miner_launchd_parent))
fields:
  - UtcTime
  - Computer
  - User
  - UserId
  - EffectiveUserId
  - GroupId
  - Image
  - CommandLine
  - ParentImage
  - ParentCommandLine
  - CurrentDirectory
  - ProcessId
  - ParentProcessId
falsepositives:
  - Authorized security validation reproducing the vulnerable UID and GID combination on an isolated Mac
  - Authorized cryptocurrency-mining research or RandomX benchmarking on an isolated lab Mac
level: critical
tags:
  - attack.initial-access
  - attack.t1190
  - attack.execution
  - attack.collection
  - attack.t1005
  - attack.impact
  - attack.t1496
  - cve.2026-65400

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

273552ad-7f24-4a08-ba93-494c3fec2d58

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion