Mach-O header fields

Elastic Stack Serverless

These fields contain Mac OS Mach Object file format (Mach-O) metadata.

Warning

These fields are in beta and are subject to change.

Mach-O header field details

Field	Description	Level
macho.go_import_hash	A hash of the Go language imports in a Mach-O file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. The algorithm used to calculate the Go symbol hash and a reference implementation are available here: https://github.com/elastic/toutoumomoma type: keyword example: `10bddcb4cee42080f76c88d9ff964491`	extended
macho.go_imports	List of imported Go language element names and types. type: flattened	extended
macho.go_imports_names_entropy	Shannon entropy calculation from the list of Go imports. type: long	extended
macho.go_imports_names_var_entropy	Variance for Shannon entropy calculation from the list of Go imports. type: long	extended
macho.go_stripped	Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable. type: boolean	extended
macho.import_hash	A hash of the imports in a Mach-O file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. This is a synonym for symhash. type: keyword example: `d41d8cd98f00b204e9800998ecf8427e`	extended
macho.imports	List of imported element names and types. type: flattened Note: this field should contain an array of values.	extended
macho.imports_names_entropy	Shannon entropy calculation from the list of imported element names and types. type: long	extended
macho.imports_names_var_entropy	Variance for Shannon entropy calculation from the list of imported element names and types. type: long	extended
macho.sections	An array containing an object for each section of the Mach-O file. The keys that should be present in these objects are defined by sub-fields underneath `macho.sections.*`. type: nested Note: this field should contain an array of values.	extended
macho.sections.entropy	Shannon entropy calculation from the section. type: long	extended
macho.sections.name	Mach-O Section List name. type: keyword	extended
macho.sections.physical_size	Mach-O Section List physical size. type: long	extended
macho.sections.var_entropy	Variance for Shannon entropy calculation from the section. type: long	extended
macho.sections.virtual_size	Mach-O Section List virtual size. This is always the same as `physical_size`. type: long	extended
macho.symhash	A hash of the imports in a Mach-O file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. This is a Mach-O implementation of the Windows PE imphash type: keyword example: `d3ccf195b62a9279c3c19af1080497ec`	extended

Field reuse

The macho fields are expected to be nested at:

file.macho
process.macho

Note also that the macho fields are not expected to be used directly at the root of the events.