Techniques › T1205.002 › AN0464
AN0464 Analytic 0464
macOS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Process opens /dev/bpf* (libpcap) or loads NetworkExtension filter, then after a crafted inbound packet the same process initiates an outbound connection to the trigger origin.</p>
- Detects
- T1205.002 Socket Filters
- Part of
- DET0162 Socket-filter trigger → on-host raw-socket activity → reverse connection (T1205.002)
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| OpenBSM:AuditTrail | open/openat of /dev/bpf*; ioctl BIOCSETF-like operations. | DC0032 Process Creation |
| macos:unifiedlog | First outbound connection from the same PID/user shortly after an inbound trigger. | DC0082 Network Connection Creation |
| NSM:Flow | Inbound one-off packet to uncommon port → outbound SF to same src_ip within TimeWindow. | DC0085 Network Traffic Content |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
BPFDevicePath | Alternate BPF device paths if customized (default /dev/bpf*). |
DeveloperMode | Relax thresholds on known developer tooling hosts (Xcode, instrumenting tools). |