User Keychain copied via Script Interpreter

[rule]
description = """
Detects when Osascript spawns the cp binary to copy the user's Keychain file. Threat actors execute scripts that copies
sensitive files to staging locations before exfiltration. This activity is highly suspicious and indicative of
credential theft attempts.
"""
id = "1bd903b1-b40b-4cb0-8c84-f982fc044c11"
license = "Elastic License v2"
name = "User Keychain copied via Script Interpreter"
os_list = ["macos"]
reference = ["https://www.jamf.com/blog/jtl-digitstealer-macos-infostealer-analysis/"]
version = "1.0.1"

query = '''
process where event.type == "start" and event.action == "exec" and process.name == "cp"  
and process.parent.name in ("osascript", "node") and process.command_line : "*keychain*"
'''

min_endpoint_version = "8.11.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"
[[threat.technique.subtechnique]]
id = "T1555.001"
name = "Keychain"
reference = "https://attack.mitre.org/techniques/T1555/001/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.11.0"