Potential XCSSET Malware Infection

[rule]
description = """
Identifies the execution traces of the XCSSET malware. XCSSET is a macOS trojan that primarily spreads via Xcode
projects and maliciously modifies applications. Infected users are also vulnerable to having their credentials,
accounts, and other vital data stolen.
"""
id = "875b71bb-ef09-46b2-9c12-a95112461e85"
license = "Elastic License v2"
name = "Potential XCSSET Malware Infection"
os_list = ["macos"]
reference = ["https://malpedia.caad.fkie.fraunhofer.de/details/osx.xcsset"]
version = "1.0.26"

query = '''
process where event.action == "exec" and
 (
  (process.name in ("curl", "nscurl") and process.parent.name in ("bash", "sh", "zsh") and
   process.args like~ ("https://*/sys/log.php", "https://*/sys/prepod.php", "https://*/sys/bin/Pods")) or

  (process.name == "osacompile" and process.args like~ "/Users/*/Library/Group Containers/*" and process.parent.name in ("bash", "sh", "zsh")) or

  (process.name == "plutil" and process.args like "LSUIElement" and process.args like~ "/Users/*/Library/Group Containers/*" and process.parent.name in ("bash", "sh", "zsh")) or

  (process.name == "zip" and process.args == "-r" and process.args like~ "/Users/*/Library/Group Containers/*")
 )
'''

min_endpoint_version = "8.10.2"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"

[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "8.10.2"