Update links and formatting

Author: RavenTait

detections/endpoint/macos_account_created.yml

@@ -9,7 +9,7 @@ description: The following analytic detects the creation of a new local user acc
 data_source:
     - osquery
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*sysadminctl","*createhomedir*","*dseditgroup*") OR (Processes.process = "*dscl*" AND Processes.process IN ("*-create*","*-passwd*")) by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_account_created_filter`'
-how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://github.com/d1vious/TA-osquery) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
+how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
 known_false_positives: Creating new accounts after initial endpoint management should be rare in most environments.
 references:
     - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/
@@ -31,7 +31,9 @@ rba:
         - field: dest
           type: system
           score: 18
-    threat_objects: []
+    threat_objects:
+        - field: process
+          type: process
 tags:
     analytic_story:
         - MacOS Persistence Techniques

detections/endpoint/macos_data_chunking.yml

@@ -9,7 +9,7 @@ description: The following analytic detects suspicious data chunking activities
 data_source:
     - osquery
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("dd *","*split *") by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_data_chunking_filter`'
-how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://github.com/d1vious/TA-osquery) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
+how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
 known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
 references:
     - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/
@@ -31,7 +31,9 @@ rba:
         - field: dest
           type: system
           score: 49
-    threat_objects: []
+    threat_objects:
+        - field: process
+          type: process
 tags:
     analytic_story:
         - MacOS Post-Exploitation

detections/endpoint/macos_gatekeeper_bypass.yml

@@ -8,8 +8,8 @@ type: TTP
 description: Detects known MacOS security bypass techniques that may be used to enable malicious code execution. Specifically monitors for attempts to remove the com.apple.quarantine attribute using xattr, or to disable Gatekeeper protections via spctl --master-disable, both of which can allow untrusted or malicious applications to execute without standard system safeguards.
 data_source:
     - osquery
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*xattr*" AND Processes.process = "*com.apple.quarantine*") OR (Processes.process = "*spctl*" AND Processes.process = "*master-disable*") by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `macos_gatekeeper_bypass_filter`'
-how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://github.com/d1vious/TA-osquery) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*xattr*" AND Processes.process = "*com.apple.quarantine*") OR (Processes.process = "*spctl*" AND Processes.process = "*master-disable*") by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_gatekeeper_bypass_filter`'
+how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
 known_false_positives: Administrators or power users may need to disable Gatekeeper to install unsigned tools.
 references:
     - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/
@@ -31,7 +31,9 @@ rba:
         - field: dest
           type: system
           score: 55
-    threat_objects: []
+    threat_objects:
+        - field: process
+          type: process
 tags:
     analytic_story:
         - MacOS Privilege Escalation

detections/endpoint/macos_hidden_files_and_directories.yml

@@ -9,7 +9,7 @@ description: The following analytic detects suspicious creation of hidden files
 data_source:
     - osquery
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process="*chflags *" AND Processes.process="* hidden*") OR (Processes.process="*xattr *" AND Processes.process="* -c *") by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_hidden_files_and_directories_filter`'
-how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://github.com/d1vious/TA-osquery) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
+how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
 known_false_positives: Power users or developers utilizing build tools or CI/CD tools could trigger this activity.
 references:
     - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/
@@ -31,7 +31,9 @@ rba:
         - field: dest
           type: system
           score: 35
-    threat_objects: []
+    threat_objects:
+        - field: process
+          type: process
 tags:
     analytic_story:
         - MacOS Persistence Techniques

detections/endpoint/macos_kextload_usage.yml

@@ -9,7 +9,7 @@ description: Detects execution of the kextload command on macOS systems. The kex
 data_source:
     - osquery
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "kextload" by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_kextload_usage_filter`'
-how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://github.com/d1vious/TA-osquery) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
+how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
 known_false_positives: Administrators installing new drivers could use this application.
 references:
     - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/
@@ -31,7 +31,9 @@ rba:
         - field: dest
           type: system
           score: 55
-    threat_objects: []
+    threat_objects:
+        - field: process
+          type: process
 tags:
     analytic_story:
         - MacOS Privilege Escalation

detections/endpoint/macos_keychains_dumped.yml

@@ -9,7 +9,7 @@ description: Detects command-line attempts to access or dump macOS Keychain file
 data_source:
     - osquery
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*/library/keychains*","*keychaindump*") by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_keychains_dumped_filter`'
-how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://github.com/d1vious/TA-osquery) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
+how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
 known_false_positives: Administrators accessing keychain files for troubleshooting or endpoint management.
 references:
     - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/

detections/endpoint/macos_log_removal.yml

@@ -9,7 +9,7 @@ description: Detects the deletion or modification of logs on MacOS systems by id
 data_source:
     - osquery
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*rm *" AND Processes.process = "*system.log*") OR (Processes.process = "*audit*" AND Processes.process = "* -s *" AND Processes.process = "*system.log*") by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_log_removal_filter`'
-how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://github.com/d1vious/TA-osquery) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
+how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
 known_false_positives: Legitimate log rotation or administrative cleanup of system or audit logs.
 references:
     - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/
@@ -31,7 +31,9 @@ rba:
         - field: dest
           type: system
           score: 55
-    threat_objects: []
+    threat_objects:
+        - field: process
+          type: process
 tags:
     analytic_story:
         - MacOS Post-Exploitation

detections/endpoint/macos_loginhook_persistence.yml

@@ -9,7 +9,7 @@ description: Identifies attempts to configure a macOS LoginHook via the defaults
 data_source:
     - osquery
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*defaults *" AND Processes.process = "*write*" AND Processes.process = "*loginwindow*" AND Processes.process = "*loginhook*" by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_loginhook_persistence_filter`'
-how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://github.com/d1vious/TA-osquery) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
+how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
 known_false_positives: This method is possibly still used by legacy enterprise management scripts. Update filter macro to remove false positives.
 references:
     - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/
@@ -31,7 +31,9 @@ rba:
         - field: dest
           type: system
           score: 75
-    threat_objects: []
+    threat_objects:
+        - field: process
+          type: process
 tags:
     analytic_story:
         - MacOS Post-Exploitation

detections/endpoint/macos_network_share_discovery.yml

@@ -9,7 +9,7 @@ description: Identifies execution of network share enumeration commands (smbutil
 data_source:
     - osquery
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*showmount *" OR Processes.process = "*smbutil *" by Processes.dest Processes.original_file_name Processes.parent_process_id Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_current_directory Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos_network_share_discovery_filter`'
-how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://github.com/d1vious/TA-osquery) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
+how_to_implement: This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
 known_false_positives: Administrators may utilize these tools occasionaly for troubleshooting.
 references:
     - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/
@@ -31,7 +31,9 @@ rba:
         - field: dest
           type: system
           score: 18
-    threat_objects: []
+    threat_objects:
+        - field: process
+          type: process
 tags:
     analytic_story:
         - MacOS Post-Exploitation