Quarantine Cleared via Xattr Followed by Ad-hoc Codesign

[rule]
description = """
Identifies recursive clearing of extended attributes with xattr -rc immediately followed by ad-hoc codesigning using a
dash identity (codesign --sign -). Malware and stealers use this chain to remove the quarantine flag from downloaded
payloads and apply an ad-hoc signature so binaries can run with fewer Gatekeeper prompts.
"""
id = "2b792fe4-bcda-4ee7-ba6c-4a90c7fc9c4e"
license = "Elastic License v2"
name = "Quarantine Cleared via Xattr Followed by Ad-hoc Codesign"
os_list = ["macos"]
version = "1.0.1"

query = '''
sequence by process.parent.entity_id with maxspan=30s
  [process where event.type == "start" and event.action == "exec" and process.name == "xattr" and 
   (
     process.args in ("-rc", "-cr") or 
     (process.args == "-r" and process.args == "-c") or 
     (process.args == "-d" and process.args == "com.apple.quarantine")
    ) and 
    
   /* https://github.com/NousResearch/hermes-agent/blob/main/scripts/install.sh#L2349 */
   not process.Ext.effective_parent.executable like "/Volumes/Hermes*/Hermes.app/Contents/MacOS/Hermes-Setup" and 
   not process.args like "/Users/*/.hermes/hermes-agent/apps/desktop/release/mac-arm64/Hermes.app" and 

   not process.Ext.effective_parent.executable == "/Applications/Cursor.app/Contents/MacOS/Cursor"
   ]
  [process where event.type == "start" and event.action == "exec" and
   process.name == "codesign" and
   process.args in ("--sign", "-s") and process.args in ("--force", "-f") and process.args == "--deep"]
'''

min_endpoint_version = "8.11.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1553"
name = "Subvert Trust Controls"
reference = "https://attack.mitre.org/techniques/T1553/"
[[threat.technique.subtechnique]]
id = "T1553.001"
name = "Gatekeeper Bypass"
reference = "https://attack.mitre.org/techniques/T1553/001/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.11.0"