Reflective Dylib Load

[rule]
description = """
Detects the potential loading of a dylib from memory by looking for dylib load events without a dll.path present
indicating the dylib was not loaded from disk. Loading a dylib directly into memory is a technique often used by
attackers to evade detection. This is because loading a dylib directly into memory leaves no traces on the disk, making
it harder for security tools or analysts to detect the malicious dylib.
"""
id = "d94b90a5-e9fd-4997-9920-13c283683634"
license = "Elastic License v2"
name = "Reflective Dylib Load"
os_list = ["macos"]
reference = [
    "https://github.com/MythicAgents/poseidon/tree/master/Payload_Type/poseidon/agent_code/execute_memory",
    "https://github.com/slyd0g/SwiftInMemoryLoading",
    "https://github.com/xpn/DyldDeNeuralyzer/tree/main",
]
version = "1.0.39"

query = '''
library where ((event.action == "load" and not dll.path : "?*") or 
 (event.action == "load" and dll.name like "NSCreateObjectFileImageFromMemory*")) and 
 process.name != null and
 process.executable != null and
 ((process.code_signature.trusted == false or process.code_signature.exists == false) or
  process.name like~ ("osascript", "bash", "sh", "zsh", "node")) and
 not process.code_signature.signing_id like "com.steinberg.cubase*" and
 not process.executable like "/private/tmp/PKInstallSandbox.*" and
 not Effective_process.executable like ("/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon",
                                        "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfManagementService.app/Contents/MacOS/JamfManagementService",
                                        "/Library/Kandji/Kandji Agent.app/Contents/Helpers/Kandji Library Manager.app/Contents/MacOS/kandji-library-manager",
                                        "/Library/Intune/Microsoft Intune Agent.app/Contents/MacOS/IntuneMdmDaemon", 
                                        "/Applications/iZotope Product Portal.app/Contents/MacOS/Product Portal")
'''

min_endpoint_version = "8.11.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1106"
name = "Native API"
reference = "https://attack.mitre.org/techniques/T1106/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1620"
name = "Reflective Code Loading"
reference = "https://attack.mitre.org/techniques/T1620/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.11.0"