Executable File Extracted to Temporary Directory

[rule]
description = """
Detects a compressed executable file is extracted to a tmp directory. Threat actors will sometimes drop a compressed
file and extract its contents (usually containing a payload) to a tmp directory in order to avoid being seen on the
system.
"""
id = "24fa0f80-7e3a-4b27-801a-30ef53f190bf"
license = "Elastic License v2"
name = "Executable File Extracted to Temporary Directory"
os_list = ["macos"]
reference = [
    "https://www.jamf.com/blog/cryptojacking-macos-malware-discovered-by-jamf-threat-labs/?utm_source=twitter&utm_medium=social&utm_campaign=blog-promo&utm_content=2023-02-23_shared_",
]
version = "1.0.37"

query = '''
file where event.action != "deletion" and 
 process.name in ("bsdtar", "tar", "unzip", "Archive Utility", "ArchiveService") and
 file.path like ("/tmp/*", "/private/var/tmp/*", "/var/tmp/*") and
 file.Ext.header_bytes like~ ("cffaedfe*", "cafebabe*") and
 not file.path like~ "/private/var/tmp/*bazel*" and
 not Effective_process.executable in ("/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon",
                                      "/Applications/NinjaRMMAgent/programfiles/ninjarmm-macagent",
                                      "/Library/Application Support/TrendMicro/RPD/RecoveryPackDownloader.app/Contents/MacOS/RecoveryPackDownloader",
                                      "/Applications/Utilities/NacAgent.app/Contents/MacOS/NacAgent",
                                      "/Applications/Warp.app/Contents/MacOS/stable",
                                      "/usr/libexec/xpcproxy",
                                      "/Library/Developer/PrivateFrameworks/CoreSimulator.framework/Versions/A/XPCServices/SimulatorTrampoline.xpc/Contents/MacOS/SimulatorTrampoline",
                                      "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfManagementService.app/Contents/MacOS/JamfManagementService",
                                      "/Library/Kandji/Kandji Agent.app/Contents/Helpers/Kandji Library Manager.app/Contents/MacOS/kandji-library-manager",
                                      "/opt/jc/bin/jumpcloud-agent",
                                      "/Library/Iru/Iru Agent.app/Contents/Helpers/Iru Library Manager.app/Contents/MacOS/kandji-library-manager")
'''

min_endpoint_version = "8.10.2"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.10.2"