Skip to content

[Deprecate] LaunchDaemon Creation or Modification and Immediate Loading #4547

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 18 commits into from
Apr 22, 2025
Merged

[Deprecate] LaunchDaemon Creation or Modification and Immediate Loading #4547

merged 18 commits into from
Apr 22, 2025

Conversation

DefSecSentinel
Copy link
Contributor

Summary

In my tuning PR (#4546) I updated the LaunchAgent Creation or Modification and Immediate Loading rule to encompass both Launch Daemons and Launch Agents using our newer Persistence event eliminating the need for this rule. The new rule name is Launch Service Creation and Immediate Loading.

@DefSecSentinel DefSecSentinel self-assigned this Mar 19, 2025
@github-actions GitHub Actions
Copy link
Contributor

Rule: Deprecation - Guidelines

These guidelines serve as a reminder set of considerations when recommending the deprecation of a rule.

Documentation and Context

  • Description of the reason for deprecation.
  • Include any context or historical data supporting the deprecation decision.

Rule Metadata Checks

  • deprecated = true added to the rule metadata.
  • updated_date should be the date of the PR.

Testing and Validation

  • A prior rule tuning occurred for the rule where Deprecated - is prepended to the rule name, and the rule has already been released.
  • Rule has be moved to the _deprecated directory.
  • Double check gaps potentially or inadvertently introduced.
  • Provide evidence that the rule is no longer needed or has been replaced (e.g., alternative rules, updated detection methods).

@tradebot-elastic
Copy link

tradebot-elastic commented Mar 19, 2025 •
edited
Loading

⛔️ Tests failed:

  • ❌ LaunchDaemon Creation or Modification and Immediate Loading (eql)
    • coverage_issue: deprecated_with_rta
    • stack_validation_failed: no_alerts - 0 alerts

terrancedejesus
terrancedejesus approved these changes Mar 20, 2025
View reviewed changes
Copy link
Contributor

@terrancedejesus terrancedejesus left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pending name change to include Deprecate - suffix and remove final deprecation stages.

@tradebot-elastic
Copy link

tradebot-elastic commented Mar 21, 2025 •
edited
Loading

⛔️ Tests failed:

  • ❌ LaunchDaemon Creation or Modification and Immediate Loading (eql)
    • coverage_issue: deprecated_with_rta
    • stack_validation_failed: no_alerts - 0 alerts

@DefSecSentinel DefSecSentinel mentioned this pull request Mar 24, 2025
Open
@tradebot-elastic
Copy link

tradebot-elastic commented Mar 26, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ LaunchDaemon Creation or Modification and Immediate Loading (eql)
    • coverage_issue: deprecated_with_rta
    • stack_validation_failed: no_alerts - 0 alerts

@tradebot-elastic
Copy link

tradebot-elastic commented Mar 28, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ LaunchDaemon Creation or Modification and Immediate Loading (eql)
    • coverage_issue: deprecated_with_rta
    • stack_validation_failed: no_alerts - 0 alerts

@tradebot-elastic
Copy link

tradebot-elastic commented Apr 1, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ LaunchDaemon Creation or Modification and Immediate Loading (eql)
    • coverage_issue: deprecated_with_rta
    • stack_validation_failed: no_alerts - 0 alerts

w0rk3r
w0rk3r requested changes Apr 2, 2025
View reviewed changes
Copy link
Contributor

@w0rk3r w0rk3r left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pending changes to the rule before the real deprecation. ref

@tradebot-elastic
Copy link

tradebot-elastic commented Apr 3, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ LaunchDaemon Creation or Modification and Immediate Loading (eql)
    • coverage_issue: deprecated_with_rta
    • stack_validation_failed: no_alerts - 0 alerts

@tradebot-elastic
Copy link

tradebot-elastic commented Apr 11, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ LaunchDaemon Creation or Modification and Immediate Loading (eql)
    • coverage_issue: deprecated_with_rta
    • stack_validation_failed: no_alerts - 0 alerts

@tradebot-elastic
Copy link

tradebot-elastic commented Apr 17, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ LaunchDaemon Creation or Modification and Immediate Loading (eql)
    • coverage_issue: deprecated_with_rta
    • stack_validation_failed: no_alerts - 0 alerts

@DefSecSentinel DefSecSentinel requested a review from w0rk3r April 21, 2025 13:17
@tradebot-elastic
Copy link

tradebot-elastic commented Apr 21, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ LaunchDaemon Creation or Modification and Immediate Loading (eql)
    • coverage_issue: deprecated_with_rta
    • stack_validation_failed: no_alerts - 0 alerts

@tradebot-elastic
Copy link

tradebot-elastic commented Apr 21, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ LaunchDaemon Creation or Modification and Immediate Loading (eql)
    • coverage_issue: deprecated_with_rta
    • stack_validation_failed: no_alerts - 0 alerts

@tradebot-elastic
Copy link

tradebot-elastic commented Apr 21, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Deprecated - LaunchDaemon Creation or Modification and Immediate Loading (eql)
    • stack_validation_failed: no_alerts - 0 alerts

@tradebot-elastic
Copy link

tradebot-elastic commented Apr 21, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Deprecated - LaunchDaemon Creation or Modification and Immediate Loading (eql)
    • stack_validation_failed: no_alerts - 0 alerts

@tradebot-elastic
Copy link

tradebot-elastic commented Apr 22, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Deprecated - LaunchDaemon Creation or Modification and Immediate Loading (eql)
    • stack_validation_failed: no_alerts - 0 alerts

@tradebot-elastic
Copy link

tradebot-elastic commented Apr 22, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Deprecated - LaunchDaemon Creation or Modification and Immediate Loading (eql)
    • stack_validation_failed: no_alerts - 0 alerts

@tradebot-elastic
Copy link

tradebot-elastic commented Apr 22, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Deprecated - LaunchDaemon Creation or Modification and Immediate Loading (eql)
    • stack_validation_failed: no_alerts - 0 alerts

@tradebot-elastic
Copy link

tradebot-elastic commented Apr 22, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Deprecated - LaunchDaemon Creation or Modification and Immediate Loading (eql)
    • stack_validation_failed: no_alerts - 0 alerts

@tradebot-elastic
Copy link

tradebot-elastic commented Apr 22, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Deprecated - LaunchDaemon Creation or Modification and Immediate Loading (eql)
    • stack_validation_failed: no_alerts - 0 alerts

@shashank-elastic shashank-elastic merged commit c80319d into main Apr 22, 2025
11 checks passed
@shashank-elastic shashank-elastic deleted the deprecatemac branch April 22, 2025 15:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@w0rk3r w0rk3r w0rk3r approved these changes

@shashank-elastic shashank-elastic shashank-elastic approved these changes

@terrancedejesus terrancedejesus terrancedejesus approved these changes

@Samirbous Samirbous Awaiting requested review from Samirbous

@Aegrah Aegrah Awaiting requested review from Aegrah

Assignees

@DefSecSentinel DefSecSentinel

Labels
backport: auto Domain: Endpoint OS: macOS Rule: Deprecation removal of a rule
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@DefSecSentinel @tradebot-elastic @w0rk3r @shashank-elastic @terrancedejesus