Code Editor Untrusted or Unsigned Child Process Execution

[rule]
description = """
Detects when a code editor (VSCode, Cursor, or IntelliJ IDEA) spawns a shell to execute a self-signed and untrusted
binary. This activity is indicative of a malicious 3rd party plugin or extension.
"""
id = "9b9776bb-6bf3-4c06-94ff-64159b52a2f3"
license = "Elastic License v2"
name = "Code Editor Untrusted or Unsigned Child Process Execution"
os_list = ["macos"]
version = "1.0.19"

query = '''
process where event.type == "start" and event.action == "exec" and
 process.Ext.effective_parent.executable in ("/Applications/IntelliJ IDEA.app/Contents/MacOS/idea",
                                             "/Applications/Visual Studio Code.app/Contents/MacOS/Electron",
                                             "/Applications/Cursor.app/Contents/MacOS/Cursor") and 
 process.parent.name in ("bash", "sh", "zsh") and
 (process.code_signature.trusted == false or process.code_signature.exists == false) and 
 process.code_signature.signing_id regex~ """[A-Za-z0-9\_\s]{2,}\-[a-z0-9]{40}""" and 
 process.args_count <= 4 and
 not process.executable like~
                          ("/opt/homebrew/*",
                           "/Users/*/.homebrew/Cellar/*",
                           "/nix/store/*",
                           "/usr/local/microsoft/powershell/7/pwsh", 
                           "/usr/local/Cellar/*",
                           "/opt/nordic/ncs/toolchains/*/Cellar/*",
                           "/Users/*/homebrew/Cellar/*") and 
 not process.command_line like~ ("bento completion zsh --silent", "*http://localhost*") and
 not process.code_signature.signing_id like~ ("python3-*", 
                                              "ruby-*", 
                                              "python-*", 
                                              "node-*", 
                                              "rg-*")
'''

min_endpoint_version = "8.7.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.7.0"