Execution of Self-Signed Binary from Volume Mount

[rule]
description = """
Detects the execution of a binary, from a volume mount, that has been self-signed using the native Codesign tool. The
specific code sign identifier scheme generated by this process matches on almost all North Korean payloads as they have
used this method to sign their malware like AppleJeus, for example, and most recently the 3CX supply chain 2nd stage
malware payload.
"""
id = "ac494288-08e1-4597-9a04-3526144de479"
license = "Elastic License v2"
name = "Execution of Self-Signed Binary from Volume Mount"
os_list = ["macos"]
version = "1.0.4"

query = '''
process where event.type == "start" and event.action == "exec" and 
 process.code_signature.signing_id regex~ """[A-Za-z0-9\_\s]{2,}\-[a-z0-9]{40}""" and
 process.code_signature.trusted == false and 
 process.args_count <= 2 and 
 process.executable like "/Volumes/*"
'''

min_endpoint_version = "8.5.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.5.0"