Potential Python Stealer

[rule]
description = """
Detects the execution of a Python script followed by at least 3 consecutive access attempts on sensitive files within a
30 second window.
"""
id = "107fe9a2-6743-4136-a055-fa070fd38f2f"
license = "Elastic License v2"
name = "Potential Python Stealer"
os_list = ["macos"]
reference = [
    "https://unit42.paloaltonetworks.com/slow-pisces-new-custom-malware/",
    "https://slowmist.medium.com/cryptocurrency-apt-intelligence-unveiling-lazarus-groups-intrusion-techniques-a1a6efda7d34",
]
version = "1.0.7"

query = '''
sequence by process.entity_id with maxspan=30s
[process where event.type == "start" and event.action == "exec" and
  process.name like~ "python*" and process.args_count == 2 and 
  process.args like ("/Users/Shared/*", 
                     "/tmp/*", 
                     "/private/tmp/*", 
                     "/var/tmp/*",
                     "/var/root/*",
                     "/private/var/root/*", 
                     "/private/var/tmp/*")]
[file where event.action == "open"] as event0
[file where event.action == "open" and not file.path == event0.file.path] as event1
[file where event.action == "open" and not file.path == event1.file.path and not file.path == event0.file.path]
'''

min_endpoint_version = "8.16.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.006"
name = "Python"
reference = "https://attack.mitre.org/techniques/T1059/006/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"
[[threat.technique.subtechnique]]
id = "T1552.001"
name = "Credentials In Files"
reference = "https://attack.mitre.org/techniques/T1552/001/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.16.0"