Emond Clients
Overview
Evidence: Emond Clients
Description: Collect Emond Clients
Category: System
Platform: macos
Short Name: emnd
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
Emond (event monitor daemon) can execute client scripts based on rules. This data is essential for detecting persistence via emond client files.
Data Collected
This collector gathers structured data about emond clients.
Emond Clients Data
| Field | Description | Example |
|---|---|---|
FileName | File Name | Example value |
FullPath | Full Path | Example value |
Hash | Hash | Example value |
FileSize | File Size | 123 |
Modified | Modified | 2023-10-15 14:30:25+03:00 |
Accessed | Accessed | 2023-10-15 14:30:25+03:00 |
Changed | Changed | 2023-10-15 14:30:25+03:00 |
Collection Method
This collector enumerates /private/var/db/emondClients/ and records file metadata and hashes into emond_clients.
Forensic Value
This evidence is crucial for forensic investigations as emond clients have been used by malware for persistence.