Detect CVE-2026-65400 Screen Sharing exploitation via SSFileCopy helpers by shashank-elastic · Pull Request #6675 · elastic/detection-rules

shashank-elastic · 2026-08-19T12:24:37Z

Pull Request

Issue link(s): NA

Summary - What I changed

Adds SIEM coverage for exploitation of the macOS Screen Sharing pre-authentication bypass (CVE-2026-65400), which is under active exploitation in the wild to gain root and deploy cryptominers.
Detection anchors on the Screen Sharing file-copy helpers SSFileCopySender and SSFileCopyReceiver, which perform privileged file operations during exploitation.
https://nvd.nist.gov/vuln/detail/CVE-2026-65400
https://www.huntress.com/blog/macos-screen-sharing-rce-patched

How To Test

Process Events

File Events

Checklist

Added a label for the type of pr: bug, enhancement, schema, maintenance, Rule: New, Rule: Deprecation, Rule: Tuning, Hunt: New, or Hunt: Tuning so guidelines can be generated
Added the meta:rapid-merge label if planning to merge within 24 hours
Secret and sensitive material has been managed correctly
Automated testing was updated or added to match the most common scenarios
Documentation and comments were added for features that require explanation

Contributor checklist

Have you signed the contributor license agreement?
Have you followed the contributor guidelines?

elastic-vault-github-plugin-prod · 2026-08-19T12:25:17Z

⛔️ Test failed

Results

❌ SSFileCopyReceiver Writing to Common Persistence Locations (eql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta
❌ SSFileCopySender Executed as Root (kuery)
- coverage_issue: no_rta
- stack_validation_failed: no_rta

elastic-vault-github-plugin-prod · 2026-08-19T12:48:00Z

⛔️ Test failed

Results

❌ SSFileCopyReceiver Writing to Common Persistence Locations (eql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta
❌ SSFileCopySender Executed as Root (kuery)
- coverage_issue: no_rta
- stack_validation_failed: no_rta

Copilot

Pull request overview

Adds new macOS Elastic Defend detection rules to identify suspected exploitation activity related to CVE-2026-65400 (Screen Sharing), focusing on the Screen Sharing file-copy helper binaries and their related persistence behaviors.

Changes:

Adds a file-based EQL rule to detect SSFileCopyReceiver writing to common macOS persistence locations.
Adds a process-based rule intended to detect anomalous SSFileCopySender execution consistent with pre-auth exploitation attempts.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
rules/macos/persistence_ssfilecopyreceiver_file_writes.toml	New EQL file-write detection for `SSFileCopyReceiver` targeting persistence-relevant paths.
rules/macos/initial_access_ssfilecopysender_root_execution.toml	New process execution detection for `SSFileCopySender` intended to flag pre-auth exploitation indicators.

Suppressed comments (1)

rules/macos/initial_access_ssfilecopysender_root_execution.toml:100

This rule is set to type = "query", but the query body is EQL (process where ...). Set the rule type to "eql" (and ensure language = "eql") or rewrite the query in KQL.

type = "query"

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+        "/Library/LaunchDaemons/*.plist",
+        "/Library/LaunchAgents/*.plist",
+        "/Users/*/Library/LaunchAgents/*.plist",
+        "/private/var/*/Library/LaunchAgents/*.plist"


+    file.name in (
+        ".zshenv", ".zshrc", ".zprofile", ".zlogin",
+        ".bashrc", ".bash_profile", ".bash_login", ".profile",
+        "config.fish", "environment.plist"
+    ) or


+id = "T1098.004"
+name = "SSH Authorized Keys"
+reference = "https://attack.mitre.org/techniques/T1098/004/"
+


elastic-vault-github-plugin-prod · 2026-08-19T12:57:33Z

⛔️ Test failed

Results

❌ SSFileCopyReceiver Writing to Common Persistence Locations (eql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta
❌ SSFileCopySender Executed as Root (eql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta

elastic-vault-github-plugin-prod · 2026-08-19T14:01:23Z

⛔️ Test failed

Results

❌ SSFileCopyReceiver Writing to Common Persistence Locations (eql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta
❌ SSFileCopySender Executed as Root (eql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta

Co-authored-by: Eric Forte <119343520+eric-forte-elastic@users.noreply.github.com>

elastic-vault-github-plugin-prod · 2026-08-20T07:27:25Z

⛔️ Test failed

Results

❌ SSFileCopyReceiver Writing to Common Persistence Locations (eql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta
❌ SSFileCopySender Executed as Root (eql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta

elastic-vault-github-plugin-prod · 2026-08-20T07:29:22Z

⛔️ Test failed

Results

❌ SSFileCopyReceiver Writing to Common Persistence Locations (eql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta
❌ SSFileCopySender Executed as Root (eql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta

elastic-vault-github-plugin-prod · 2026-08-20T08:30:18Z

⛔️ Test failed

Results

❌ SSFileCopyReceiver Writing to Common Persistence Locations (eql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta
❌ SSFileCopySender Executed as Root (eql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta

elastic-vault-github-plugin-prod · 2026-08-20T09:49:37Z

⛔️ Test failed

Results

❌ SSFileCopyReceiver Writing to Common Persistence Locations (eql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta
❌ SSFileCopySender Executed as Root (eql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta

elastic-vault-github-plugin-prod · 2026-08-24T14:25:38Z

⛔️ Test failed

Results

❌ SSFileCopyReceiver Writing to Common Persistence Locations (esql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta
❌ SSFileCopySender Executed as Root (esql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

elastic-vault-github-plugin-prod · 2026-08-25T11:52:25Z

⛔️ Test failed

Results

❌ SSFileCopyReceiver Writing to Common Persistence Locations (esql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta
❌ SSFileCopySender Executed as Root (esql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta

elastic-vault-github-plugin-prod · 2026-08-25T12:25:38Z

⛔️ Test failed

Results

❌ SSFileCopyReceiver Writing to Common Persistence Locations (esql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta
❌ SSFileCopySender Executed as Root (esql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta

elastic-vault-github-plugin-prod · 2026-08-31T04:53:14Z

⛔️ Test failed

Results

❌ SSFileCopyReceiver Writing to Common Persistence Locations (esql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta
❌ SSFileCopySender Executed as Root (esql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta

elastic-vault-github-plugin-prod · 2026-08-31T04:57:10Z

⛔️ Test failed

Results

❌ SSFileCopyReceiver Writing to Common Persistence Locations (esql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta
❌ SSFileCopySender Executed as Root (esql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta

elastic-vault-github-plugin-prod · 2026-08-31T05:29:15Z

⛔️ Test failed

Results

❌ SSFileCopyReceiver Writing to Common Persistence Locations (esql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta
❌ SSFileCopySender Executed as Root (esql)
- coverage_issue: no_rta
- stack_validation_failed: no_rta

Detect CVE-2026-65400 Screen Sharing exploitation via SSFileCopy helpers

bd4d36e

shashank-elastic self-assigned this Aug 19, 2026

Query ++ Investigation guides

3944128

shashank-elastic marked this pull request as ready for review August 19, 2026 12:47

Copilot AI lite review requested due to automatic review settings August 19, 2026 12:47

github-actions Bot added the backport: auto label Aug 19, 2026

shashank-elastic requested a review from a team August 19, 2026 12:47

Copilot started reviewing on behalf of shashank-elastic August 19, 2026 12:48 View session

Copilot AI reviewed Aug 19, 2026

View reviewed changes

botelastic Bot added Domain: Endpoint OS: macOS labels Aug 19, 2026

Modify language

4ee25a8

Modify type

4a570b2

eric-forte-elastic reviewed Aug 19, 2026

View reviewed changes

Comment thread rules/macos/persistence_ssfilecopyreceiver_file_writes.toml Outdated

eric-forte-elastic reviewed Aug 19, 2026

View reviewed changes

Comment thread rules/macos/persistence_ssfilecopyreceiver_file_writes.toml Outdated

Accept File path changes

ffe8868

Co-authored-by: Eric Forte <119343520+eric-forte-elastic@users.noreply.github.com>

Make event type unambiguos

155e86a

shashank-elastic requested review from Aegrah, Samirbous, bryans3c and eric-forte-elastic August 20, 2026 07:29

Fix query syntax

9fe1b16

Merge branch 'main' into CVE-2026-65400

367e568

Samirbous reviewed Aug 24, 2026

View reviewed changes

Comment thread rules/macos/persistence_ssfilecopyreceiver_file_writes.toml Outdated

Samirbous reviewed Aug 24, 2026

View reviewed changes

Comment thread rules/macos/initial_access_ssfilecopysender_root_execution.toml Outdated

Change to ESQL query

1b3808f

shashank-elastic requested a review from Samirbous August 24, 2026 14:26

Samirbous reviewed Aug 24, 2026

View reviewed changes

PR review comments

359c992

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

shashank-elastic requested a review from Samirbous August 25, 2026 11:52

Aegrah approved these changes Aug 25, 2026

View reviewed changes

PR review

b4a0dc2