User Keychain copied via Shell interpreter

[rule]
description = """
Detects when the copy command is used to copy the user keychain database via a shell interpreter. Some recent malware
stealer samples have been seen using this technique to retrieve sensitive files prior to exfiltration. The copying of
the user keychain database is not normal activity under almost any circumstance and should be considered highly
suspicious if not malicious.
"""
id = "8b0e22e0-dfee-46fa-8695-be94334d34f1"
license = "Elastic License v2"
name = "User Keychain copied via Shell interpreter"
os_list = ["macos"]
reference = ["https://hunt.io/blog/macos-malware-impersonates-the-unarchiver-app-to-steal-user-data"]
version = "1.0.3"

query = '''
process where event.type == "start" and event.action == "exec" and process.name == "cp" and 
 process.command_line like~ "*/Users/*/Library/Keychains/login.keychain-db*" and 
 process.parent.name in~ ("bash", "zsh", "sh", "Terminal")
'''

min_endpoint_version = "8.11.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"
[[threat.technique.subtechnique]]
id = "T1555.001"
name = "Keychain"
reference = "https://attack.mitre.org/techniques/T1555/001/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.11.0"