AppleScript Decoded via Base64

[rule]
description = """
Detects when AppleScript is executed followed by the execution of the Base64 binary with the decode option set. Several
malware samples have been observed executing base64 encoded AppleScript in order to avoid detection.
"""
id = "9602ed93-b5cf-4397-ba37-6e752082847c"
license = "Elastic License v2"
name = "AppleScript Decoded via Base64"
os_list = ["macos"]
version = "1.0.8"

query = '''
sequence with maxspan=10s
[process where event.type == "start" and event.action == "exec" and process.parent.name == "osascript" and 
  (process.name in ("bash", "zsh", "sh", "dash", "csh", "tcsh", "ksh", "tclsh", "fish") or process.name like "tclsh*") and process.args == "-c"] by process.entity_id
[process where event.type == "start" and event.action == "exec" and (process.name in ("bash", "zsh", "sh", "dash", "csh", "tcsh", "ksh", "tclsh", "fish", "base64") or process.name like "tclsh*") and
  process.command_line like~ "*base64*-d*"] by process.parent.entity_id
'''

min_endpoint_version = "8.11.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.002"
name = "AppleScript"
reference = "https://attack.mitre.org/techniques/T1059/002/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1027"
name = "Obfuscated Files or Information"
reference = "https://attack.mitre.org/techniques/T1027/"

[[threat.technique]]
id = "T1140"
name = "Deobfuscate/Decode Files or Information"
reference = "https://attack.mitre.org/techniques/T1140/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.11.0"