An IOC for OSX/Keydnap - <http://www.welivesecurit...
# general
m
An IOC for OSX/Keydnap - http://www.welivesecurity.com/2016/08/30/osxkeydnap-spreads-via-signed-transmission-application/:
Copy code
select * from file 
where path in (
  '/Applications/Transmission.app/Contents/Resources/License.rtf', 
  '/Volumes/Transmission/Transmission.app/Contents/Resources/License.rtf', 
  '/Library/Application Support/com.apple.iCloud.sync.daemon/'
) 
or path like '/Users/%/Library/Application Support/com.apple.iCloud.sync.daemon/icloudsyncd' 
or path like '/Users/%/Library/Application Support/com.apple.iCloud.sync.daemon/process.id' 
or path like '/Users/%/Library/LaunchAgents/com.apple.iCloud.sync.daemon.plist' 
or path like '/Users/%/Library/LaunchAgents/com.geticloud.icloud.photo.plist’
or path like ‘/Users/%/Downloads/Transmission2.92.dmg';