Suspicious Task for Pid System Call

[rule]
description = """
Identifies when a process invoke the task_for_pid system service which gives a process the capability to control another
process. A process needs root privileges to call task_for_pid or possesses the com.apple.security.get-task-allow
entitlement. This type of behavior may indicate inter-process code injection or legit debugging activity. Adversaries
may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges.
"""
id = "572ec53e-fc79-43ad-8bdd-573999ff70d7"
license = "Elastic License v2"
name = "Suspicious Task for Pid System Call"
os_list = ["macos"]
reference = [
    "http://os-tres.net/blog/2010/02/17/mac-os-x-and-task-for-pid-mach-call/",
    "https://knight.sc/malware/2019/03/15/code-injection-on-macos.html",
    "https://blog.xpnsec.com/macos-injection-via-third-party-frameworks/",
    "https://wojciechregula.blog/post/learn-xpc-exploitation-part-3-code-injections/",
]
version = "1.0.38"

query = '''
process where event.action == "process_open" and
 (process.code_signature.trusted == false or process.code_signature.exists == false) and 
 not process.executable like~ ("/private/var/folders/*", 
                               "/Users/*/.pyenv/*",
                               "/opt/homebrew/*",
                               "/nix/store/*",
                               "/Users/*/.homebrew/*",
                               "/Users/*/miniconda3/envs/*",
                               "/usr/local/Cellar/*",
                               "/usr/local/Caskroom/*",
                               "/System/*") and 
  not process.name == "htop" and 
  not Target.process.executable like "/Users/*/anaconda3/envs/python*" and
  not (startswith~(process.parent.executable, Target.process.executable) or 
   startswith~(process.executable, Target.process.executable)) and 
  not process.hash.sha256 : ("d41e02b5366b186a237f33150baa7c5ef4747ba06646a193ab9ba5125fc6ef7a",
                             "bee1a00ffb1c4b7c2c4784a1fdcb849dc7853b9deb5173ff4c5a08209c84bc26",
                             "6ac6f81d80afff9b6ee9d3608d9964566a39188d0166ae867df97c624e632b98",
                             "8698f4e54c64667c4a4c7ccde3fbcd7babc6478a5e8e22732732f633cc2fc499") and 
  not (process.executable like "/Users/*/micromamba/envs/grid/bin/python*" and Target.process.executable in ("/bin/bash", "/usr/bin/which", "/usr/bin/uname")) and
  not (process.executable like "/Users/*/.local/share/uv/python/cpython-*-macos-aarch64-none/bin/python*" and Target.process.executable like "/Users/*/Code/eis-ray/.venv/lib/python*/site-packages/ray/core/src/ray/gcs/gcs_server") and 
  not (process.executable like "/Users/*/anaconda?/bin/python*" and Target.process.executable like "/Users/*/anaconda?/envs/python*/bin/python*")
'''

min_endpoint_version = "8.4.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.4.0"