Decoy Document Creation via Curl

[rule]
description = """
Detects when Curl is seen creating a .pdf or .doc file in a suspicious directory like /tmp or /users/shared. A recent
DPRK sample was seen downloading a decoy document via Curl like this.
"""
id = "a39d0c2f-30d0-4a32-b198-41b135f85bad"
license = "Elastic License v2"
name = "Decoy Document Creation via Curl"
os_list = ["macos"]
reference = ["https://www.kandji.io/blog/todoswift-disguises-malware-download-behind-bitcoin-pdf"]
version = "1.0.13"

query = '''
sequence by process.entity_id with maxspan=1m
[process where event.type == "start" and event.action == "exec" and process.name in ("curl", "nscurl")]
[file where event.action == "modification" and file.path like ("/tmp/*", "/private/tmp/*", "/Users/Shared/*", "/Users/*/Library/*") and
 file.extension in ("pdf", "doc") and process.name in ("curl", "nscurl") and
 not Effective_process.executable like~ (
  "/Applications/Cursor.app/Contents/MacOS/Cursor",
  "/Applications/Codex.app/Contents/MacOS/*",
  "/Applications/ChatGPT.app/Contents/MacOS/ChatGPT",
  "/Applications/Visual Studio Code.app/Contents/MacOS/Code",
  "/Users/*/Library/Application Support/Claude/claude-code/*/claude.app/Contents/MacOS/claude",
  "/Applications/Visual Studio Code.app/Contents/MacOS/Electron"
) and not 
(Effective_process.executable like "/Applications/Microsoft Word.app/Contents/MacOS/Microsoft Word" and 
  file.path like "/Users/*/Library/Containers/com.microsoft.Word/Data/tmp/Content.MSO/*") and 
 not file.path like "/private/tmp/claude*"]
'''

min_endpoint_version = "8.11.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "Effective_process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"
[[threat.technique.subtechnique]]
id = "T1204.002"
name = "Malicious File"
reference = "https://attack.mitre.org/techniques/T1204/002/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.11.0"