Cloud Credential Files Accessed by Osascript

[rule]
description = """
Identifies the Osascript process accessing cloud credential and configuration files. Adversaries may attempt to access
these files in order to gain access to sensitive data, laterally move or gain initial access into a cloud environment.
"""
id = "a8b16aed-8ba0-45e7-8a73-088a3017de28"
license = "Elastic License v2"
name = "Cloud Credential Files Accessed by Osascript"
os_list = ["macos"]
version = "1.0.5"

query = '''
file where event.action == "open" and 
 file.path like~ ("/Users/*/.aws/*", "/Users/*/.config/gcloud/credentials.db", "/Users/*/.azure/*") and 
 process.name == "osascript"
'''

min_endpoint_version = "8.11.1"
optional_actions = []
[[actions]]
action = "kill_process"
field = "Effective_process.executable"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"
[[threat.technique.subtechnique]]
id = "T1552.001"
name = "Credentials In Files"
reference = "https://attack.mitre.org/techniques/T1552/001/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.11.1"