Curl Download and Execution of JavaScript Payload

[rule]
description = """
Identifies when curl is used to download a JavaScript payload and subsequently execute it using the built-in osascript
utility. An adversary may use this technique to execute their malicious payload and obtain initial access to an
endpoint.
"""
id = "871f0c30-a7c5-40a5-80e3-a50c6714632f"
license = "Elastic License v2"
name = "Curl Download and Execution of JavaScript Payload"
os_list = ["macos"]
reference = ["https://github.com/its-a-feature/Mythic"]
version = "1.0.46"

query = '''
sequence by process.parent.entity_id with maxspan=15s
  [process where event.action == "exec" and
    process.name in ("curl", "nscurl") and process.args like ("-o", "--output", "-O", "--remote-name") and process.parent.name in~ ("bash", "zsh", "sh", "Terminal") and 
    not process.args like ("https://*.jamfcloud.com/JSSResource/computercommands/command/BlankPush/id/*", "POST")]
  [process where event.action == "exec" and process.name == "osascript" and
    (process.args == "-e" or process.args == "-l") and
    not process.Ext.effective_parent.executable in
                                                  ("/usr/local/jamf/bin/jamf",
                                                   "/Library/Addigy/auditor",
                                                   "/opt/jc/bin/jumpcloud-agent",
                                                   "/Library/Intune/Microsoft Intune Agent.app/Contents/MacOS/IntuneMdmDaemon", 
                                                   "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon", 
                                                   "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfManagementService.app/Contents/MacOS/JamfManagementService") and 
    not process.command_line : ("osascript -e display dialog \"Please advise your Support Representative of the following error:\\r\\r• Dialog Team ID verification failed\\r\\r\" with title \"Setup Your Mac: Error\" buttons {\"Close\"} with icon caution", 
                                "osascript -e display dialog \"Please advise your Support Representative of the following error:\\r\\r• Dialog Team ID verification failed\\r\\r\" with title \"App Auto-Patch: Error\" buttons {\"Close\"} with icon caution") and
    not process.parent.command_line == "/bin/bash /Library/Management/super/super"
    ]
'''

min_endpoint_version = "8.16.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.007"
name = "JavaScript"
reference = "https://attack.mitre.org/techniques/T1059/007/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.16.0"