Kerberos Config File Accessed by Osascript

[rule]
description = """
Identifies the Osascript process accessing the Kerberos configuration file. Adversaries may attempt to access this file
in order to gain situational awareness regarding the Active Directory domain to include its structure and settings.
"""
id = "ac72d6b3-c647-42e3-bafc-03ccf3180204"
license = "Elastic License v2"
name = "Kerberos Config File Accessed by Osascript"
os_list = ["macos"]
version = "1.0.6"

query = '''
file where event.action == "open" and 
 file.path like "/etc/krb5.conf" and 
 process.name == "osascript"
'''

min_endpoint_version = "8.11.1"
optional_actions = []
[[actions]]
action = "kill_process"
field = "Effective_process.executable"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.002"
name = "AppleScript"
reference = "https://attack.mitre.org/techniques/T1059/002/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1082"
name = "System Information Discovery"
reference = "https://attack.mitre.org/techniques/T1082/"


[threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[internal]
min_endpoint_version = "8.11.1"