Suspicious OpenSSL Execution via macOS Application

[rule]
description = """
Detects a suspicious sequence of events where a shell (bash, sh, or zsh) is used to launch an application from the
/Applications directory, followed by the execution of the 'openssl' command. This pattern could indicate potential
malicious activity, such as a shell script attempting to use openssl to perform encryption or decryption operations,
exfiltrating sensitive data, or interacting with command and control servers. Monitoring for such sequences can help
identify potentially compromised systems or unauthorized activities. This rule alerts on Shlayer malware activity.
"""
id = "8f00ad1b-d04a-466e-819b-39cd2a80b877"
license = "Elastic License v2"
name = "Suspicious OpenSSL Execution via macOS Application"
os_list = ["macos"]
reference = ["https://objective-see.org/blog/blog_0x70.html", "https://attack.mitre.org/techniques/T1140/"]
version = "1.0.20"

query = '''
sequence by process.parent.entity_id with maxspan=30s
[process where event.type == "start" and (process.name in ("bash", "sh", "zsh", "dash", "csh", "tcsh", "ksh", "tclsh", "fish") or process.name like "tclsh*") and
  process.args like ("*/bin/bash", "*/bin/sh", "*/bin/zsh", "*/bin/dash", "*/bin/csh", "*/bin/tcsh", "*/bin/ksh", "*/bin/tclsh*", "*/bin/fish") and
  process.args like ("/Applications/*", "/Volumes/*") and
  process.args_count <= 2] 
[process where event.type == "start" and process.name == "openssl" and
  not process.parent.executable like "/Library/PrivilegedHelperTools/com.amazonaws.acvc.helper" and
  not process.Ext.effective_parent.executable like ("/usr/local/jamf/*",
                                                    "/Applications/AWS VPN Client/AWS VPN Client.app/Contents/Resources/openvpn/openssl",
                                                    "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon")]
'''

min_endpoint_version = "8.5.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"


[[threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"
[[threat.technique.subtechnique]]
id = "T1204.002"
name = "Malicious File"
reference = "https://attack.mitre.org/techniques/T1204/002/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1027"
name = "Obfuscated Files or Information"
reference = "https://attack.mitre.org/techniques/T1027/"

[[threat.technique]]
id = "T1140"
name = "Deobfuscate/Decode Files or Information"
reference = "https://attack.mitre.org/techniques/T1140/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.5.0"