File Made Executable via Package Install Script

[rule]
description = """
Detects when a file in a suspicious file path is made executable via the chmod binary immediately after an installer pkg
is executed via the postinstall script. This is not a common occurrence and indicates the installation of a malicious
binary.
"""
id = "75f5d51a-218f-4d5b-80e5-eb74e498fde4"
license = "Elastic License v2"
name = "File Made Executable via Package Install Script"
os_list = ["macos"]
version = "1.0.27"

query = '''
sequence by process.parent.pid with maxspan=30s
[process where event.type == "start" and event.action == "fork" and 
    process.name like~ ("bash", "zsh", "sh", "python*", "tclsh*", "dash", "csh", "tcsh", "ksh", "fish") and
    process.args like~ "/tmp/PKInstallSandbox.*/Scripts/*/postinstall" and 
    process.args like ("/Users/*", "/Volumes/*") and 
    not process.args like "/Applications/Adobe Acrobat DC"]
[process where event.type == "start" and event.action == "exec" and 
    process.name == "chmod" and 
    process.args in ("+x", "a+x", "0777", "777") and
    process.args like~ ("/private/tmp/*", 
                        "/var/tmp/*", 
                        "/var/lib/*",
                        "/tmp/*", 
                        "/var/folders/*", 
                        "/Users/Shared/*", 
                        "/Library/Containers/*", 
                        "/Users/*/Library/*",
                        "/Users/*/Applications/*",
                        "/var/root/*", 
                        "/Library/WebServer/*",
                        "/Library/Fonts/*",
                        "/usr/local/bin/*") and
    process.parent.name like~ ("bash", "zsh", "sh", "python*", "tclsh*", "osascript", "dash", "csh", "tcsh", "ksh", "fish") and not
    process.command_line == "chmod +x decompress"]
'''

min_endpoint_version = "8.11.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1222"
name = "File and Directory Permissions Modification"
reference = "https://attack.mitre.org/techniques/T1222/"
[[threat.technique.subtechnique]]
id = "T1222.002"
name = "Linux and Mac File and Directory Permissions Modification"
reference = "https://attack.mitre.org/techniques/T1222/002/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.11.0"