---
title: Suspicious Mobile Configuration Profile Download
id: 8d4e9b1a-2c3f-4a5b-9c6d-1e2f3a4b5c6d
status: experimental
description: Detects the download of Apple mobile configuration files (.mobileconfig) which are often used in social engineering campaigns to install malicious profiles or root CAs.
references:
  - https://support.apple.com/guide/security/welcome/web
author: Security Arsenal
date: 2026/04/10
tags:
  - attack.initial_access
  - attack.t1566.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\opera.exe'
    CommandLine|contains: '.mobileconfig'
  condition: selection
falsepositives:
  - Legitimate IT support requesting profile installation
level: medium
---
title: Potential Spyware C2 Traffic on Non-Standard Port
id: 9f5a0b2c-3d4e-5f6a-0b1c-2d3e4f5a6b7c
status: experimental
description: Detects processes establishing network connections to non-standard ports often used by spyware for Command and Control (C2) to evade standard web filtering.
references:
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/04/10
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort|notin:
      - 80
      - 443
      - 22
      - 53
      - 88
      - 445
      - 3389
    Initiated: 'true'
  condition: selection
falsepositives:
  - Legitimate business applications using custom ports
level: low
---
title: MacOS Configuration Profile Installation
id: a0b1c2d3-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects the installation of configuration profiles on macOS via command line, which could indicate a compromise attempting to install a root CA or proxy.
references:
  - https://attack.mitre.org/techniques/T1648/
author: Security Arsenal
date: 2026/04/10
tags:
  - attack.initial_access
  - attack.t1648
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith:
      - '/profiles'
      - '/usr/sbin/install'
    CommandLine|contains: '-install'
  condition: selection
falsepositives:
  - System administrators managing devices
level: high

// Hunt for downloads of mobile configuration files on Windows devices
DeviceProcessEvents  
| where Timestamp > ago(7d)  
| where FileName in~ ("chrome.exe", "msedge.exe", "firefox.exe")  
| where ProcessCommandLine contains ".mobileconfig"  
| project DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, Timestamp
| order by Timestamp desc


// Detect suspicious network connections that might indicate C2 beacons
DeviceNetworkEvents  
| where Timestamp > ago(30d)  
| where RemotePort !in (80, 443, 22, 53, 25, 587) and InitiatingProcessIsNetworkInitiated == false  
| summarize count() by DeviceName, RemoteUrl, RemotePort  
| where count_ < 10 // Filter for rare connections
| join kind=inner (DeviceProcessEvents) on DeviceName
| project DeviceName, RemoteUrl, RemotePort, FileName, ProcessCommandLine, Timestamp

-- Hunt for mobile configuration files in user downloads
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs='C:\Users\*\Downloads\*.mobileconfig')

-- Hunt for mobile configuration files on macOS
SELECT FullPath, Size, Mode.Symlink, Mtime
FROM glob(globs='/Users/*/Downloads/*.mobileconfig')

<#
.SYNOPSIS
    Checks user download directories for suspicious mobile configuration files.
#>

$Users = Get-ChildItem -Path "C:\Users" -Directory
$SuspiciousFiles = @()

foreach ($User in $Users) {
    $DownloadPath = Join-Path -Path $User.FullName -ChildPath "Downloads"
    if (Test-Path -Path $DownloadPath) {
        $Files = Get-ChildItem -Path $DownloadPath -Filter "*.mobileconfig" -ErrorAction SilentlyContinue
        if ($Files) {
            foreach ($File in $Files) {
                $SuspiciousFiles += [PSCustomObject]@{
                    User      = $User.Name
                    FileName  = $File.Name
                    FilePath  = $File.FullName
                    Created   = $File.CreationTime
                    Accessed  = $File.LastAccessTime
                }
            }
        }
    }
}

if ($SuspiciousFiles.Count -gt 0) {
    Write-Warning "Suspicious mobile configuration files found!"
    $SuspiciousFiles | Format-Table -AutoSize
} else {
    Write-Host "No mobile configuration files found in user download directories."
}