File: santa2.log

package info (click to toggle)
plaso 20241006-3
  • links: PTS, VCS
  • area: main
  • in suites: trixie
  • size: 673,224 kB
  • sloc: python: 91,831; sh: 557; xml: 97; makefile: 17; sql: 14; vhdl: 11
file content (11 lines) | stat: -rw-r--r-- 3,023 bytes parent folder | download | duplicates (2) 
1
2
3
4
5
6
7
8
9
10
11
 
[2022-02-09T16:47:01.893Z] I santad: action=EXEC|decision=ALLOW|reason=CERT|sha256=6107671d8e280d9c00f34fdcff9875fbeddddaf5dbf458612383fa20f5ad67b2|cert_sha256=d84db96af8c2e60ac4c851a21ec460f6f84e0235beb17d24a78712b9b021ed57|cert_cn=Software Signing|pid=75780|pidversion=1765713|ppid=155|uid=0|user=root|gid=1|group=daemon|mode=L|path=/bin/ps|args=/bin/ps -x -o utime,stime -p 57680
[2022-02-09T16:47:02.893Z] I santad: action=EXIT|pid=75780|pidversion=1765713|ppid=155|uid=0|gid=1
[2022-02-09T16:47:03.093Z] I santad: action=WRITE|path=/Users/testuser/Library/Application Support/Google/Chrome/Default/.com.google.Chrome.ZDfRQN|pid=83049|pidversion=1175762|ppid=83034|process=Google Chrome Helper|processpath=/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/98.0.4758.80/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper|uid=726654|user=testuser|gid=89939|group=primarygroup
[2022-02-17T16:30:05.253Z] I santad: action=RENAME|path=/private/var/db/santa/santa.log.5.gz|newpath=/private/var/db/santa/santa.log.6.gz|pid=26150|pidversion=2228280|ppid=1|process=newsyslog|processpath=/usr/sbin/newsyslog|uid=0|user=root|gid=0|group=wheel
[2022-02-17T16:30:05.257Z] I santad: action=LINK|path=/private/var/db/santa/santa.log|newpath=/private/var/db/santa/santa.log.0|pid=26150|pidversion=2228280|ppid=1|process=newsyslog|processpath=/usr/sbin/newsyslog|uid=0|user=root|gid=0|group=wheel
[2022-02-17T16:30:05.363Z] I santad: action=DELETE|path=/System/Library/AssetsV2/SplunkRecords/59F396EB-4D7A-4C88-B7BC-3354C2DDD06C|pid=310|pidversion=685|ppid=1|process=mobileassetd|processpath=/usr/libexec/mobileassetd|uid=0|user=root|gid=0|group=wheel
[2022-02-17T16:31:28.414Z] I santad: action=EXEC|decision=ALLOW|reason=BINARY|explain=critical system binary|sha256=25977d1584525b571fc6d19dcac1a768d0555c58777876869255de312dcfcaf3|cert_sha256=d84db96af8c2e60ac4c851a21ec460f6f84e0235beb17d24a78712b9b021ed57|cert_cn=Software Signing|pid=26364|pidversion=2228711|ppid=1|uid=0|user=root|gid=0|group=wheel|mode=M|path=/usr/libexec/xpcproxy|args=xpcproxy com.apple.mdworker.shared.07000000-0000-0000-0000-000000000000
[2022-02-17T17:33:02.759Z] I santad: action=DISKAPPEAR|mount=|volume=git-428557911.461|bsdname=disk3s1|fs=apfs|model=Apple Disk Image|serial=|bus=Virtual Interface|dmgpath=/tmp/git3627116198/payload/git.dmg|appearance=2022-02-17T17:33:02.159Z
[2022-02-17T17:33:03.719Z] I santad: action=DISKAPPEAR|mount=|volume=git-428557911.461|bsdname=disk3s1|fs=apfs|model=Apple Disk Image|serial=|bus=Virtual Interface|dmgpath=/tmp/git3627116198/payload/git.dmg|appearance=2022-02-17T17:33:03.102Z
[2022-02-17T17:33:03.841Z] I santad: action=DISKAPPEAR|mount=/private/tmp/dmg.FW6SCj|volume=git-428557911.461|bsdname=disk3s1|fs=apfs|model=Apple Disk Image|serial=|bus=Virtual Interface|dmgpath=/tmp/git3627116198/payload/git.dmg|appearance=2022-02-17T17:33:03.102Z
[2022-02-17T17:33:02.778Z] I santad: action=DISKDISAPPEAR|mount=|volume=git-428557911.461|bsdname=disk3s1