Find DMG Files

When Cybereason identifies a malicious file, it is useful to identify the mount point from which the file originated. In Mac environments, DMG files (Apple Disk images) are a type of mount point. When opened, DMG files are mounted to a file system and can be accessed. Once mounted, an attacker can execute a file contained in the DMG or copied to the Applications folder. Every executable file associated with a DMG can be traced back to the DMG file that created it, even if the DMG file created a local instances run from outside the DMG.

The example queries in this section are meant to be a starting point for your investigations. You may need to update the Features (filters) in each query to use indicators specific to your environment or situation.

Find files or processes originating from DMG files

Request

curl --request POST \
  --url https://12.34.56.78/rest/visualsearch/query/simple \
  --header 'Content-Type: application/json' \
  --data '{
            "queryPath":[
                          {
                            "requestedType":"File",
                            "connectionFeature": {
                                                  "elementInstanceType":"File",
                                                  "featureName":"mount"
                                                 }
                          },
                          {
                            "requestedType":"MountPoint",
                            "filters": [
                                        {
                                          "facetName":"mediaType",
                                          "values": [
                                                      "Image"
                                                    ],
                                          "filterType":"Equals"
                                        }
                                       ],
                            "isResult":true
                          }
                        ],
            "totalResultLimit":1000,
            "perGroupLimit":100,
            "perFeatureLimit":100,
            "templateContext":"SPECIFIC",
            "queryTimeout":120000,
            "customFields": [
                              "deviceName",
                              "mediaType",
                              "volumeName",
                              "ownerMachine",
                              "files",
                              "elementDisplayName"
                            ]
          }'

Find mount points that mount DMG files

Request

curl --request POST \
  --url https://12.34.56.78/rest/visualsearch/query/simple \
  --header 'Content-Type: application/json' \
  --data ' {
            "queryPath":[
                          {
                            "requestedType": "MountPoint",
                            "filters":[
                                        {
                                          "facetName": "mediaType",
                                          "values":
                                                    [
                                                      "Image"
                                                    ],
                                          "filterType": "Equals"
                                        }
                                      ],
                            "isResult": true
                          }
                        ],
            "totalResultLimit": 1000,
            "perGroupLimit": 100,
            "perFeatureLimit": 100,
            "templateContext": "SPECIFIC",
            "queryTimeout": 120000,
            "customFields": [
                              "deviceName",
                              "mediaType",
                              "volumeName",
                              "ownerMachine",
                              "files",
                              "elementDisplayName"
                            ]
            }'

Response

{
  "data": {
    "resultIdToElementDataMap": {
      "-1485635450.-1260330527608509961": {
        "simpleValues": {
          "mediaType": {
            "totalValues": 1,
            "values": [
              "Image"
            ]
          },
          "deviceName": {
            "totalValues": 1,
            "values": [
              "/home/disk2s1"
            ]
          },
          "elementDisplayName": {
            "totalValues": 1,
            "values": [
              "/Volumes/Funter"
            ]
          }
        },
        "elementValues": {
          "ownerMachine": {
            "totalValues": 1,
            "elementValues": [
              {
                "elementType": "Machine",
                "guid": "-1485635450.1198775089551518743",
                "name": null,
                "hasSuspicions": false,
                "hasMalops": false
              }
            ],
            "totalSuspicious": 0,
            "totalMalicious": 0
          }
        },
        "suspicions": {},
        "filterData": {
          "sortInGroupValue": "-1485635450.-1260330527608509961",
          "groupByValue": "MountPointRuntime:-1485635450.-1260330527608509961 name=/Volumes/User , "
        },
        "isMalicious": false,
        "suspicionCount": 0,
        "guidString": "-1485635450.-1260330527608509961",
        "labelsIds": null,
        "malopPriority": null
      }
    },
    "suspicionsMap": {},
    "evidenceMap": {},
    "totalPossibleResults": 1,
    "queryLimits": {
      "totalResultLimit": 1000,
      "perGroupLimit": 100,
      "perFeatureLimit": 100,
      "groupingFeature": {
        "elementInstanceType": "MountPoint",
        "featureName": "self"
      },
      "sortInGroupFeature": null
    },
    "queryTerminated": false,
    "pathResultCounts": [
      {
        "featureDescriptor": {
          "elementInstanceType": "MountPoint",
          "featureName": null
        },
        "count": 1
      }
    ]
  },
  "status": "SUCCESS",
  "message": ""
}

Find DMG files that were mounted

Request

curl --request POST \
  --url https://12.34.56.78/rest/visualsearch/query/simple \
  --header 'Content-Type: application/json' \
  --data ' {
            "queryPath": [
                          {
                            "requestedType":"MountPoint",
                            "filters": [
                                        {
                                          "facetName": "mediaType",
                                          "values": [
                                                      "Image"
                                                    ],
                                          "filterType": "Equals"
                                        }
                                       ],
                            "isResult": true
                          }
                         ],
            "totalResultLimit": 1000,
            "perGroupLimit": 100,
            "perFeatureLimit": 100,
            "templateContext": "SPECIFIC",
            "queryTimeout": 120000,
            "customFields": [
                              "deviceName",
                              "mediaType",
                              "volumeName",
                              "ownerMachine",
                              "files",
                              "elementDisplayName"
                            ]
           }'