Mach-O File with Unusual Extension

[rule]
description = """
Identifies the creation or modification of an Mach-O file with an unexpected file extension. Attackers may attempt to
evade detection by masquerading files using the file extension values used by image, audio, or document file types.
"""
id = "9c5c3957-f8cb-4225-ad07-e5a6325eafb2"
license = "Elastic License v2"
name = "Mach-O File with Unusual Extension"
os_list = ["macos"]
version = "1.0.15"

query = '''
file where event.action in ("modification", "rename", "open") and

 file.Ext.header_bytes like~ ("cffaedfe*", "cafebabe*") and

 (
   /* common image file extensions */
   file.extension in ("jpg", "jpeg", "emf", "tiff", "gif", "png", "bmp", "fpx", "eps", "svg", "inf") or

   /* common audio and video file extensions */
   file.extension in ("mp3", "wav", "avi", "mpeg", "flv", "wma", "wmv", "mov", "mp4", "3gp") or

   /* common document file extensions */
   file.extension in ("txt", "pdf", "doc", "docx", "rtf", "ppt", "pptx", "xls", "xlsx", "hwp", "html") or

   /* common log, txt and temporary file extensions */
   file.extension in ("log", "conf", "txt", "nib", "ts")
  ) and
  not (process.executable in ("/bin/cp", "/bin/bash") and file.path == "/Library/PrivilegedHelperTools/us.zoom.ZoomDaemon.tmp") and
  not (file.path like~ ("/Users/*/Library/Caches/*", "/private/var/folders/*", "/Library/Application Support/CrashPlan/conf/tmp/*") and file.name : "jna*.tmp") and
  not (process.name in ("javaapplicationstub", "jspawnhelper", "java") and file.name like~ "jna*.tmp") and
  not Effective_process.executable == "/Applications/Cisco Secure Endpoint/Secure Endpoint Service.app/Contents/MacOS/ampdaemon"
'''

min_endpoint_version = "8.10.2"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1036"
name = "Masquerading"
reference = "https://attack.mitre.org/techniques/T1036/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.2"