Techniques › T1565.003 › AN1099
AN1099 Analytic 1099
macOS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Monitor for runtime manipulation by observing changes in application bundles, unexpected signing modifications, and runtime API calls that inject or alter how data is displayed. Detect alterations in CFNetwork or CoreFoundation frameworks responsible for rendering data.</p>
- Detects
- T1565.003 Runtime Data Manipulation
- Part of
- DET0391 Detection Strategy for Runtime Data Manipulation.
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| macos:unifiedlog | Unexpected application binary modifications or altered signing status | DC0059 File Metadata |
| macos:osquery | CALCULATE: Mismatch in file integrity of critical macOS applications | DC0061 File Modification |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
AllowedApps | Whitelisted applications expected to handle sensitive runtime data. |
SignatureEnforcement | Policy enforcement for validating application code signing integrity. |