Potential Masquerading as System Binary

[rule]
description = """
Detects the execution, by root, of a non-Apple binary passing the path to a System binary as command-line arguments.
This activity has only been observed being used by malware in order to masquerade as the system process for the purpose
of remaining hidden on the victim machine.
"""
id = "bb1de0c7-3504-4b31-8d3e-928aa3acf64f"
license = "Elastic License v2"
name = "Potential Masquerading as System Binary"
os_list = ["macos"]
reference = ["https://www.jamf.com/blog/cryptojacking-macos-malware-discovered-by-jamf-threat-labs"]
version = "1.0.19"

query = '''
process where event.type == "start" and event.action == "exec" and 
  process.args like "/System/*" and 
  process.parent.name in ("bash", "sh", "zsh") and 
  process.args_count == 1 and not 
  process.executable like ("/System/*", "/usr/libexec/*", "/usr/bin/*", "/usr/sbin/*", "/bin/*", "/sbin/*")
'''

min_endpoint_version = "8.10.2"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1036"
name = "Masquerading"
reference = "https://attack.mitre.org/techniques/T1036/"
[[threat.technique.subtechnique]]
id = "T1036.004"
name = "Masquerade Task or Service"
reference = "https://attack.mitre.org/techniques/T1036/004/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.2"