Threat video1:00
CVE-2024-54471 macOS NetAuthAgent Flaw: Detection & IOCs
A local process can pull iCloud tokens from macOS NetAuthAgent via CVE-2024-54471. Use 9 detection rules, 5 IOCs and a free Splunk SPL rule to spot it.
Read the full threat intel for CVE-2024-54471 macOS NetAuthAgent Flaw: Detection & IOCs →
Chapters
- 0:00The hookUnverified NetAuthAgent routine 19 leaks stored credentials.
- 0:05The storyLets any local app steal internet passwords.
- 0:11Attack pathAccording to researchers, routine 19 sends a credential request.
- 0:29AttributionNo threat actor is attributed.
- 0:34Indicators of compromise1 indicator to hunt: 1 path.
- 0:39MITRE ATT&CK techniques8 ATT&CK techniques, from initial access to collection.
- 0:44Remediation2 steps now: Update macOS to Sequoia 15.1, Sonoma.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Unverified NetAuthAgent routine 19 leaks stored credentials.
0:06Lets any local app steal internet passwords.
0:08Then decrypt iCloud data.
0:11According to researchers, routine 19 sends a credential request.
0:16Receives passwords.
0:18Recovers iCloud key.
0:19Decrypts account file, extracts API tokens.
0:23Replays them against iCloud APIs.
0:26Accesses iCloud data.
0:30No threat actor is attributed. Confidence: low.
0:341 indicator to hunt: 1 path.
0:398 ATT&CK techniques, from initial access to collection.
0:442 steps now: Update macOS to Sequoia 15.1, Sonoma.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.