Terminal closed with Pkill or Killall

[rule]
description = """
Detects when Pkill is used to close all Terminal windows with the responsible process having been executed from a volume
mount. Information stealers in particular kill or close any open Terminal windows in order to ensure their shell script
execution commands aren't observed by the user. In order to gain quick code execution these samples instruct the user to
execute their payloads directly from the volume mounted image which is not a common practice especially when paired with
uncommon commands invocations like this.
"""
id = "266f9d58-2277-4e78-b551-7d07b3ed9020"
license = "Elastic License v2"
name = "Terminal closed with Pkill or Killall"
os_list = ["macos"]
version = "1.0.9"

query = '''
process where event.type == "start" and event.action == "exec" and process.name in ("pkill", "killall") and
 process.args like~ "Terminal" and (process.parent.executable like "/Volumes/*" or process.parent.name in ("bash", "sh", "zsh") or (process.parent.code_signature.trusted == false or process.parent.code_signature.exists == false)) and
 not process.Ext.effective_parent.executable in ("/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon",
                                                 "/usr/local/jamf/bin/jamf") and
 not (process.parent.name == "bash" and process.parent.command_line == null)
'''

min_endpoint_version = "8.11.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1564"
name = "Hide Artifacts"
reference = "https://attack.mitre.org/techniques/T1564/"
[[threat.technique.subtechnique]]
id = "T1564.003"
name = "Hidden Window"
reference = "https://attack.mitre.org/techniques/T1564/003/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.11.0"