Execution of JavaScript Payload via Python

[rule]
description = """
Identifies when Python spawns the native Osascript binary to execute a Javascript payload. An adversary may use this
technique to execute their malicious payload and obtain initial access to an endpoint.
"""
id = "36536aab-671a-4f3f-aad2-8d113bedec8a"
license = "Elastic License v2"
name = "Execution of JavaScript Payload via Python"
os_list = ["macos"]
reference = ["https://github.com/MythicAgents/medusa"]
version = "1.0.10"

query = '''
process where event.action == "exec" and process.name == "osascript" and
 process.parent.name like~ "python*" and
 process.args == "-l" and process.args : "JavaScript*" and
 not process.command_line == "osascript -l JavaScript -e ObjC.import('Foundation'); ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('ManagedInstalls').objectForKey('ManagedInstallDir'))" and
 not process.Ext.effective_parent.executable in ("/usr/local/jamf/bin/jamf",
                                                 "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon", 
                                                 "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfManagementService.app/Contents/MacOS/JamfManagementService")
'''

min_endpoint_version = "8.5.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.007"
name = "JavaScript"
reference = "https://attack.mitre.org/techniques/T1059/007/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.5.0"