Hidden File Network Connection and Executable Download

[rule]
description = """
Detects when a hidden file makes an outbound network connection followed by the immediate download of an executable
file. Threat actors will often hide their payloads on disk in order to remain hidden and use them to download additional
payloads or tooling.
"""
id = "cf8a45e5-f513-498f-9de7-cf7a27fcffb0"
license = "Elastic License v2"
name = "Hidden File Network Connection and Executable Download"
os_list = ["macos"]
version = "1.0.6"

query = '''
sequence by process.entity_id with maxspan=30s
[network where event.type == "start" and process.name like~ ".*"]
[file where event.action == "modification" and file.Ext.header_bytes like~ ("cffaedfe*", "cafebabe*")]
'''

min_endpoint_version = "8.16.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1105"
name = "Ingress Tool Transfer"
reference = "https://attack.mitre.org/techniques/T1105/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "8.16.0"