Shlayer Malware Infection

[rule]
description = """
Identifies the execution of curl to download a payload for execution. This behavior is consistent with Shlayer malware.
Shlayer is a macOS malware family associated with ad fraud activity. Shlayer masquerades typically as an installer for
applications like Adobe Flash Player and executes numerous macOS commands to deobfuscate code and install adware with
persistence mechanisms.
"""
id = "3dda1ac2-86ef-41f5-ad3b-d9396383e104"
license = "Elastic License v2"
name = "Shlayer Malware Infection"
os_list = ["macos"]
reference = [
    "https://attack.mitre.org/software/S0402/",
    "https://redcanary.com/threat-detection-report/threats/shlayer/",
    "https://securelist.com/shlayer-for-macos/95724/",
]
version = "1.0.29"

query = '''
process where event.action == "exec" and process.name in ("curl", "nscurl") and process.args like "-f0L"
'''

min_endpoint_version = "8.10.2"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1105"
name = "Ingress Tool Transfer"
reference = "https://attack.mitre.org/techniques/T1105/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "8.10.2"