MacOS Hidden File Mounted

[rule]
description = """
Detects when a hidden file gets mounted, which has been observed being leveraged to exploit vulnerabilities that allow
for mounting over sensitive parts of the filesystem, thereby bypassing certain macOS security controls such as TCC and
SIP.
"""
id = "c5f219ca-4bda-461b-bc54-246c0bb48143"
license = "Elastic License v2"
name = "MacOS Hidden File Mounted"
os_list = ["macos"]
reference = [
    "https://theevilbit.github.io/posts/cve-2021-30808/",
    "https://www.trendmicro.com/en_us/research/22/l/diving-into-an-old-exploit-chain-and-discovering-3-new-sip-bypas.html",
]
version = "1.0.20"

query = '''
file where event.action == "mount" and file.path like "/private/tmp/.*" and not file.path like "/private/tmp/.easeus_rdisk"
'''

min_endpoint_version = "8.10.2"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1211"
name = "Exploitation for Defense Evasion"
reference = "https://attack.mitre.org/techniques/T1211/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.2"