Application Javascript Injection via Nodejs

[rule]
description = """
Detects when a JavaScript file within an application's directory structure gets modified via Node.js. Malicious npm
packages have been observed hijacking legitimate applications like Cursor editor by injecting malicious JavaScript code
into application files to enable persistent code execution.
"""
id = "9c20c94b-aad6-4052-b5b4-70d968e70971"
license = "Elastic License v2"
name = "Application Javascript Injection via Nodejs"
os_list = ["macos"]
reference = ["https://socket.dev/blog/malicious-npm-packages-hijack-cursor-editor-on-macos"]
version = "1.0.2"

query = '''
file where event.action == "modification" and file.extension == "js" and
 file.path like "/Applications/*" and (process.name == "node" or Effective_process.name == "node") and 
 Effective_process.executable != "/Applications/Visual Studio Code 2.app/Contents/MacOS/Electron"
'''

min_endpoint_version = "8.11.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "Effective_process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1195"
name = "Supply Chain Compromise"
reference = "https://attack.mitre.org/techniques/T1195/"
[[threat.technique.subtechnique]]
id = "T1195.001"
name = "Compromise Software Dependencies and Development Tools"
reference = "https://attack.mitre.org/techniques/T1195/001/"



[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1554"
name = "Compromise Host Software Binary"
reference = "https://attack.mitre.org/techniques/T1554/"


[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.11.0"