Brew package manager for MacOS

[M.Bamford]

We utilise Brew for package manager for our Mac in our organisation and we have over 100+ engineers using it to manage their operating environment. Cortex doesnt pick up any of the applications installed via brew or any of the vulnerabilities associated with them and only detects anything once its in a running state. 

This seems like a very basic omission in the XDR client for Mac on a few points:
- it should detect any use of a new TAP (third party repo) that is a signal for potential malicious source
- it should detect the apps/libraries installed via Brew and scan them for vulnerabilities

Does anyone have any thoughts on this?

[susekar]

Hello @M.Bamford ,

Greetings for the day.

The observations regarding the Cortex XDR agent's behavior on macOS are technically accurate given current architectural limitations.

Below is a detailed breakdown addressing the specific points about detection scope, vulnerability assessment for Homebrew, and workarounds for monitoring repository changes.

1. Vulnerability Detection for Homebrew Applications

Cortex XDR does not currently detect or scan applications installed via Homebrew for vulnerabilities because of the specific directories the agent is designed to index.

Scope Limitation:
The Cortex XDR agent on macOS is hardcoded to scan and index applications located in standard system directories, specifically /Applications, /Applications/Utilities, and /System/Applications/Utilities.

Homebrew Paths:
Homebrew installs packages into non-standard paths such as /opt/homebrew/bin/ (Apple Silicon) or /usr/local/Cellar (Intel). Because these directories are outside the agent's defined scanning scope, the applications are not added to the Asset Inventory. Consequently, the Vulnerability Assessment engine cannot match these applications against known CVEs.

Enhanced Vulnerability Assessment:
While the Enhanced Vulnerability Assessment feature (Agent 8.4+) adds local analysis capabilities, it still relies on the initial inventory discovery, which remains limited to the standard application paths mentioned above.

2. Detection at “Running State” vs. “On-Write”

The observation that detection primarily occurs when an application is in a running state is consistent with the macOS agent’s design capabilities compared to Windows.

On-Write Limitation:
The On-Write File Examination feature (scanning files immediately upon download or creation) is primarily a Windows-exclusive capability and is not supported for most file types on macOS.

Exceptions (Scripts):
An exception exists for Bash scripts (.sh). The Local File Threat Examination (LTE) module (introduced in Agent 8.2) can detect and analyze .sh scripts on-write.

Scanning Files at Rest:
To detect latent malicious files in Homebrew directories before they execute, Scheduled Scans or On-Demand Scans must be used. These scans traverse the file system to identify threats that are not currently running.

3. Detecting Third-Party Repositories (brew tap)

There is no out-of-the-box rule to detect the addition of third-party repositories via brew tap, but this can be addressed by creating a custom Behavioral Indicator of Compromise (BIOC).

Recommended Action:
Create a custom BIOC rule to alert on or block execution of the brew tap command.

XQL Query Logic:

dataset = xdr_data
| filter event_type = PROCESS
| filter agent_os_type = ENUM.AGENT_OS_MAC
| filter action_process_image_command_line contains "brew tap"

This filters for process events on macOS where the command-line arguments include brew tap.

Implementation:

• To detect the activity, save the query as a Correlation Rule.

• To block the activity, create a BIOC Rule within the Prevention Policy, ensuring the rule targets macOS explicitly to avoid false positives.

• Keep the BIOC logic simple and avoid complex regex to ensure compatibility with the Behavioral Threat Protection (BTP) engine on the agent.

Summary

The limitation regarding Homebrew vulnerability detection is due to the hardcoded scan scope of the Cortex XDR agent on macOS. For scanning files at rest, Scheduled Scans are the intended workaround. For monitoring brew tap activity, a custom BIOC rule is the standard and supported solution.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Happy New year!!

Thanks & Regards,
S. Subashkar Sekar