Quarantine Events

Overview

Evidence: Quarantine Events Description: Collect Quarantine Events Database Category: System Platform: macos Short Name: qrntn Is Parsed: Yes Sent to Investigation Hub: Yes Collect File(s): No

Background

This collector gathers quarantine events information from the macOS system. This data is essential for understanding download and execution origins, detecting initial access vectors, and investigating user-driven infections.

Data Collected

This collector gathers structured data about quarantine events.

Quarantine Events Data

Field	Description	Example
User	User	Example value
QuarantineID	Quarantine ID	Example value
Timestamp	Timestamp	2023-10-15 14:30:25+03:00
Bundle	Bundle	Example value
AgentName	Agent Name	Example value
DataURL	Data URL	Example value
SenderName	Sender Name	Example value
SenderAdd	Sender Add	Example value
TypeNum	Type Num	123
OriginTitle	Origin Title	Example value
OriginURL	Origin URL	Example value
OriginAlias	Origin Alias	Example value

Collection Method

This collector copies user quarantine databases from ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2 and parses the LSQuarantineEvent table.

Forensic Value

This evidence is crucial for forensic investigations as it reveals downloaded files, source URLs, and agent processes that can indicate phishing, drive-by downloads, or malicious attachments.