Unusual process accessed a macOS notes DB file

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-10-08

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: XDR Agent with eXtended Threat Hunting (XTH)
Detection Modules
Detector Tags	Sensitive Information Stealing Analytics
ATT&CK Tactic	Collection (TA0009)
ATT&CK Technique	Data from Information Repositories (T1213)
Severity	Informational

An unusual process has accessed a user's notes DB file.

Obtain access to user's notes and steal their contents.

Determine whether it is legitimate for the process to access user's notes.
Analyze the process/application that accessed the DB file.
Check for any other suspicious actions that were performed by the process.
Look for unusual access of resources using credentials that may be stored in the above notes.

ATT&CK Tactic	Collection (TA0009)
ATT&CK Technique	Data from Information Repositories (T1213)
Severity	Low

An unusual process has accessed a user's notes DB file.

Obtain access to user's notes and steal their contents.

Determine whether it is legitimate for the process to access user's notes.
Analyze the process/application that accessed the DB file.
Check for any other suspicious actions that were performed by the process.
Look for unusual access of resources using credentials that may be stored in the above notes.