Crypto Wallet File Access via CommandLine

[rule]
description = """
Detects the use of the Cat binary to access the contents of sensitive Crypto Wallet files. The AMOS malware along with
other stealers have been observed using this technique in order to collect sensitive file data and stage it for
exfiltration.
"""
id = "259d683b-8551-41ce-b101-d0897e530a36"
license = "Elastic License v2"
name = "Crypto Wallet File Access via CommandLine"
os_list = ["macos"]
version = "1.0.6"

query = '''
process where event.type == "start" and event.action == "exec" and process.name == "cat" and
 process.args like~ ("/Users/*/.electrum/*",
                     "/Users/*/Library/Application_Support/*/Default/Extensions/*",
                     "/Users/*/Library/Application Support/*/Default/Local Extension Settings/*",
                     "/Users/*/Library/Application Support/Electrum/*",
                     "/Users/*/Library/Application Support/Exodus/*", 
                     "/Users/*/Library/Application Support/Coinomi/*",
                     "/Users/*/Library/Application Support/Atomic/*",
                     "/Users/*/Library/Application Support/@trezor/*",
                     "/Users/*/Library/Application Support/Ledger Live/*",
                     "/Users/*/Library/Application Support/WasabiWallet/*",
                     "/Users/*/Monero/*",
                     "/Users/*/Library/Application Support/Bitcoin/*",
                     "/Users/*/Library/Application Support/Litecoin/*",
                     "/Users/*/Library/Application Support/DashCore/*",
                     "/Users/*/Library/Application Support/ElectronCash/*",
                     "/Users/*/Library/Application Support/Guarda/*",
                     "/Users/*/Library/Application Support/Dogecoin/*",
                     "/Users/*/Library/Application Support/BraveSoftware/Brave-Browser/BraveWallet/*",
                     "/Users/*/Library/Application Support/BraveSoftware/Brave-Browser/Default/Local Extension Settings/pgojbichloddijphfmfhhfolimnhjklk/*",
                     "/Users/*/Library/Application Support/Firefox/Profiles/*/extensions/*") and
  not process.Ext.effective_parent.executable in ("/Library/NessusAgent/run/sbin/nessus-service", "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon")
'''

min_endpoint_version = "8.11.1"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"
[[threat.technique.subtechnique]]
id = "T1552.001"
name = "Credentials In Files"
reference = "https://attack.mitre.org/techniques/T1552/001/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.11.1"