Execution of a File Dropped by OpenSSL

[rule]
description = """
Identifies when the OpenSSL utility creates a file followed by its execution. Malware authors may attempt to evade
detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a
disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.
"""
id = "d2017990-b448-4617-8d4a-55aa45abe354"
license = "Elastic License v2"
name = "Execution of a File Dropped by OpenSSL"
os_list = ["macos"]
reference = ["https://attack.mitre.org/software/S0482/", "https://attack.mitre.org/software/S0402/"]
version = "1.0.25"

query = '''
sequence with maxspan=1m
[file where event.action != "deletion" and process.name == "openssl"] by file.path
[process where event.action == "exec"] by process.executable
'''

min_endpoint_version = "8.10.2"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"
[[threat.technique.subtechnique]]
id = "T1204.002"
name = "Malicious File"
reference = "https://attack.mitre.org/techniques/T1204/002/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1027"
name = "Obfuscated Files or Information"
reference = "https://attack.mitre.org/techniques/T1027/"

[[threat.technique]]
id = "T1140"
name = "Deobfuscate/Decode Files or Information"
reference = "https://attack.mitre.org/techniques/T1140/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.2"