Execution of Non-Executable File via Shell

[rule]
description = """
Detects the execution of an un-executable file, per file extension, via a shell interpreter. Sometimes threat actors
will masquerade their payloads as non-executable files in order to avoid suspicion and go unnoticed.
"""
id = "c0770406-7ede-4049-a7a1-999c15fb60bd"
license = "Elastic License v2"
name = "Execution of Non-Executable File via Shell"
os_list = ["macos"]
version = "1.0.22"

query = '''
process where event.type == "start" and event.action == "exec" and 
 (process.name in ("bash", "sh", "zsh", "dash", "csh", "tcsh", "ksh", "tclsh", "fish") or process.name like "tclsh*") and
 process.command_line like ("/bin/bash *", "/bin/sh *", "/bin/zsh *", "/bin/dash *", "/bin/csh *", "/bin/tcsh *", "/bin/ksh *", "/bin/tclsh*", "/bin/fish *",
                            "/usr/bin/bash *", "/usr/bin/sh *", "/usr/bin/zsh *", "/usr/bin/dash *", "/usr/bin/csh *", "/usr/bin/tcsh *", "/usr/bin/ksh *", "/usr/bin/tclsh*", "/usr/bin/fish *",
                            "/usr/local/bin/bash *", "/usr/local/bin/sh *", "/usr/local/bin/zsh *", "/usr/local/bin/dash *", "/usr/local/bin/csh *", "/usr/local/bin/tcsh *", "/usr/local/bin/ksh *", "/usr/local/bin/tclsh*", "/usr/local/bin/fish *",
                            "/opt/homebrew/bin/bash *", "/opt/homebrew/bin/sh *", "/opt/homebrew/bin/zsh *", "/opt/homebrew/bin/dash *", "/opt/homebrew/bin/csh *", "/opt/homebrew/bin/tcsh *", "/opt/homebrew/bin/ksh *", "/opt/homebrew/bin/tclsh*", "/opt/homebrew/bin/fish *") and
 process.command_line like ("*.pid", "*.plist", "*.txt", "*.json", "*.tmp", "*.bin", "*.js", "*.nib", "*.log", "*.dat") and
 process.args_count == 2
'''

min_endpoint_version = "8.10.2"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1036"
name = "Masquerading"
reference = "https://attack.mitre.org/techniques/T1036/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.2"