Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Virtual Private Network Connection Attempt

Identifies the execution of macOS built-in commands to connect to an existing Virtual Private Network (VPN). Adversaries may use VPN connections to laterally move and control remote systems on a network.

ATT&CK coverage

Outside the enterprise matrix

T1021
T1133

Detection requirements

Log source category: event_index

What the source says

References

https://github.com/rapid7/metasploit-framework/blob/master/modules/post/osx/manage/vpn.rb
https://superuser.com/questions/358513/start-configured-vpn-from-command-line-osx
https://www.unix.com/man-page/osx/8/networksetup/

Tagged by the source as

Data Source: Elastic DefendDomain: EndpointOS: macOSResources: Investigation GuideTactic: Lateral MovementUse Case: Threat Detection

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.