In-Memory JXA Execution via ScriptingAdditions

[rule]
description = """
Detects the potential in memory load of a JXA script. JXA allows users to control applications and the operating system
using the JavaScript language. Additionally, it can be leveraged in OSAKit from within other macho binaries without
spawning the osascript binary. Malicious payloads will use OSAKit to load JXA (.js) scripts into their process memory
allowing them to execute post exploitation tasks from memory without being detected. When OSAKit is utilized to load JXA
scripts into memory AppleScript, JavaScript and StandardAdditions gets mapped into the process memory.
"""
id = "8cfda3f1-9364-4637-b779-753f6feb7acf"
license = "Elastic License v2"
name = "In-Memory JXA Execution via ScriptingAdditions"
os_list = ["macos"]
reference = ["https://github.com/MythicAgents/apfell", "https://posts.specterops.io/persistent-jxa-66e1c3cd1cf5"]
version = "1.0.27"

query = '''
sequence by process.entity_id with maxspan=10s
[library where event.action == "load" and dll.path == "/System/Library/Components/JavaScript.component/Contents/MacOS/JavaScript" and
  not process.executable like "/usr/bin/osascript"]
[library where event.action == "load" and dll.path == "/System/Library/ScriptingAdditions/StandardAdditions.osax/Contents/MacOS/StandardAdditions"]
'''

min_endpoint_version = "8.11.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1106"
name = "Native API"
reference = "https://attack.mitre.org/techniques/T1106/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1620"
name = "Reflective Code Loading"
reference = "https://attack.mitre.org/techniques/T1620/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.11.0"