Potential Data Collection in Temporary Directory by Hidden Executable

[rule]
description = """
Detects when a hidden executable creates and then immediately deletes a temporary file within a temporary directory like
/tmp. We have observed threat actors doing this for data collection, exfiltration and prompt deletion.
"""
id = "a6994646-d314-4ee0-be1f-1d694dc969e7"
license = "Elastic License v2"
name = "Potential Data Collection in Temporary Directory by Hidden Executable"
os_list = ["macos"]
version = "1.0.8"

query = '''
sequence by process.entity_id, file.path with maxspan=30s
  [file where event.action == "modification" and process.name like~ ".*" and
   file.path like ("/private/tmp/*", "/tmp/*", "/var/tmp/*") and
   not process.executable like "/nix/store/*" and
   not Effective_process.executable == "/Applications/Visual Studio Code - Insiders.app/Contents/MacOS/Code - Insiders"]
  [file where event.action == "deletion" and process.name like~ ".*" and
   file.path like ("/private/tmp/*", "/tmp/*", "/var/tmp/*") and
   not process.executable like "/nix/store/*" and
   not Effective_process.executable == "/Applications/Visual Studio Code - Insiders.app/Contents/MacOS/Code - Insiders"]
'''

min_endpoint_version = "8.11.1"
optional_actions = []
[[actions]]
action = "kill_process"
field = "Effective_process.executable"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1560"
name = "Archive Collected Data"
reference = "https://attack.mitre.org/techniques/T1560/"
[[threat.technique.subtechnique]]
id = "T1560.003"
name = "Archive via Custom Method"
reference = "https://attack.mitre.org/techniques/T1560/003/"



[threat.tactic]
id = "TA0009"
name = "Collection"
reference = "https://attack.mitre.org/tactics/TA0009/"

[internal]
min_endpoint_version = "8.11.1"