Potential WizardUpdate Malware Infection

[rule]
description = """
Identifies the execution traces of the WizardUpdate malware. WizardUpdate is a macOS trojan that attempts to infiltrate
macOS machines to steal data and it is associated with other types of malicious payloads, increasing the chances of
multiple infections on a device.
"""
id = "eb78fa0f-5e8a-4c15-a099-e904c4a226e6"
license = "Elastic License v2"
name = "Potential WizardUpdate Malware Infection"
os_list = ["macos"]
reference = [
    "https://malpedia.caad.fkie.fraunhofer.de/details/osx.xcsset",
    "https://www.microsoft.com/security/blog/2022/02/02/the-evolution-of-a-mac-trojan-updateagents-progression/",
]
version = "1.0.28"

query = '''
process where event.action == "exec" and
 (
   (process.name in ("sh", "bash", "zsh") and process.command_line : "*=$(curl *eval*$*") or
   (process.name in ("curl", "nscurl") and process.command_line : "*_intermediate_agent_*machine_id*")
 ) and 
 not process.parent.code_signature.team_id in ("UBF8T346G9", "4DE7YGRTPT", "VDXQ22DGB9", "Q6L2SF6YDW", "2DC432GLL2") and 
 process.parent.executable != null
'''

min_endpoint_version = "8.10.2"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"

[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "8.10.2"