// [T1087.002] Account Discovery - Domain Accounts - Mac
//
// https://attack.mitre.org/techniques/T1087/002/
//
// Identify Mac PR2 events with dscacheutil and group. 

#event_simpleName=ProcessRollup2 
| event_platform=Mac ImageFileName=/\/dscacheutil/i
| CommandLine=/\s+\-q.+\s+group\s+/
| select([timestamp, aid, UserSid, ParentBaseFileName, ImageFileName, CommandLine])
| sort(field=timestamp, order=asc, limit=10000)
| timestamp := formatTime("%Y-%m-%d %H:%M:%S", field=timestamp, locale=en_US, timezone=Z)