Initial Access via macOS Installer Package

[rule]
description = """
Identifies when a macOS installer package is executed followed by the execution of a utility that's commonly used by
attackers when downloading a payload, establishing persistence, profiling an endpoint, or decompressing/decoding a file
before execution. An attacker may configure an installer package to download an additional payload or malware for
execution to gain initial access or establish persistence on an endpoint.
"""
id = "d40ffcba-b83e-4d0a-8d6d-84385def8e18"
license = "Elastic License v2"
name = "Initial Access via macOS Installer Package"
os_list = ["macos"]
reference = ["https://redcanary.com/blog/clipping-silver-sparrows-wings/", "https://youtu.be/Eow5uNHtmIg"]
version = "1.0.48"

query = '''
sequence with maxspan=1m
  [process where event.action == "exec" and process.name in ("installer", "package_script_service") and not
    process.args like~
                   ("/Library/Application Support/JAMF/Downloads/*",
                    "/tmp/KSInstallAction.*",
                    "/tmp/FLEXnet", 
                    "./Epson Scanner Monitor.pkg",
                    "./Epson Event Manager.pkg",
                    "./Epson Scanner ICA Driver.pkg",
                    "/tmp/PKInstallSandbox.*/Scripts/com.epson.pkg.eventmanager.*/Epson Scanner Monitor.pkg",
                    "/Library/Addigy/ansible/packages/TeamViewer Host */TeamViewer_Host.pkg") and not
    process.parent.executable like~ ("/usr/local/ltechagent/ltupdate",
                                     "/sbin/launchd", 
                                     "/Users/*/Library/Caches/*",
                                     "/Library/PrivilegedHelperTools/*",
                                     "/Applications/Epson Software/EPSON Software Updater.app/Contents/MacOS/EPSON Software Updater",
                                     "/private/var/folders/*/download/ARMDCHammer") and not
    process.Ext.effective_parent.executable in ("/usr/local/jamf/bin/jamf",
                                                "/Library/Intune/Microsoft Intune Agent.app/Contents/MacOS/IntuneMdmDaemon",
                                                "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon",
                                                "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfManagementService.app/Contents/MacOS/JamfManagementService",
                                                "/Volumes/Fiery Software Manager/Fiery Software Manager.app/Contents/MacOS/Fiery Software Manager")]
  [process where event.action in ("exec", "fork") and

    // Descendant of macOS installer process
    descendant of [
        process where event.action == "exec" and
        process.name in ("Installer", "package_script_service") and not
        process.args like~
                       ("/Library/Application Support/JAMF/Downloads/*",
                        "/tmp/KSInstallAction.*",
                        "/tmp/PKInstallSandbox.*/Scripts/com.epson.pkg.eventmanager.*/Epson Scanner Monitor.pkg",
                        "./Epson Scanner Monitor.pkg",
                        "/tmp/FLEXnet",
                        "/Library/Preferences/com.epson.Epson Scan OCR Component Pro.XmlType.UnInstallList.plist",
                        "./Epson Event Manager.pkg",
                        "./Epson Scanner ICA Driver.pkg",
                        "/Library/Addigy/ansible/packages/TeamViewer Host */TeamViewer_Host.pkg") and not
        process.parent.executable like~
                                    ("/usr/local/ltechagent/ltupdate",
                                     "/sbin/launchd", 
                                     "/Users/*/Library/Caches/*",
                                     "/Applications/Epson Software/EPSON Software Updater.app/Contents/MacOS/EPSON Software Updater",
                                     "/Library/PrivilegedHelperTools/*",
                                     "/private/var/folders/*/download/ARMDCHammer") and not
        process.Ext.effective_parent.executable in ("/usr/local/jamf/bin/jamf",
                                                    "/Library/Intune/Microsoft Intune Agent.app/Contents/MacOS/IntuneMdmDaemon",
                                                    "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon", 
                                                    "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfManagementService.app/Contents/MacOS/JamfManagementService",
                                                    "/Volumes/Mac_User_SW/Fiery Master Installer.app/Contents/MacOS/Fiery Master Installer",
                                                    "/Volumes/Fiery Software Manager/Fiery Software Manager.app/Contents/MacOS/Fiery Software Manager")
        ] and

    (
      // curl scope limited to silver-sparrows to reduce noise
      (process.name in ("curl", "nscurl") and process.command_line : ("*.amazonaws.com*",
                                                         "*.cloudfront.net*", 
                                                         "*raw.githubusercontent.com*")) or
      // No hang up executed with a bash command
      (process.name == "nohup" and process.command_line : "* &") or
      // Open SSL used to encrypt or encode/decode data
      (process.name == "openssl" and process.args : ("-base64", "-enc")) or
      // Base64 used to decode data
      (process.name == "base64" and process.args : "-d") or
      // chmod used to make files readable, writable and executable by all users
      (process.name == "chmod" and process.args : ("+x", "a+x", "0777", "755", "777") and process.args : "/tmp/*" and
	   not process.args : ("/tmp/com.adobe.acrobat.DC", "/tmp/FLEXnet")) or
      // xattr used to change extended attributes for a file
      (process.name == "xattr" and ((process.args : "com.apple.quarantine" and 
        process.args : ("-d", "-w", "-?d", "-?w")) or
        (process.args == "-c")) and process.args : "/tmp/*") or
      (process.name == "touch" and process.args : "/tmp/*") or
      (process.name in ("bash", "sh", "zsh") and process.args == "-c" and process.args : ("*/bin/curl*.amazonaws.com*",
                                                                                        "*/bin/curl*.cloudfront.net*",
                                                                                        "*/bin/curl*raw.githubusercontent.com*",
                                                                                        "*/bin/osascript*",
                                                                                        "*/bin/wget*", 
                                                                                        "*/bin/chmod +x*", 
                                                                                        "*/bin/plutil*-convert*", 
                                                                                        "*/bin/openssl*-enc*",
                                                                                        "*/bin/openssl*-base64*",  
                                                                                        "*/bin/base64*-d*", 
                                                                                        "*/bin/xattr*com.apple.quarantine*",
                                                                                        "*/bin/touch /tmp/*"))
    ) and
    not process.parent.executable : ("/sbin/launchd", 
                                     "/Users/*/Library/Caches/*",
                                     "/Library/PrivilegedHelperTools/*",
                                     "/private/var/folders/*/download/ARMDCHammer") and not
    process.Ext.effective_parent.executable in ("/Applications/Epson Software/EPSON Software Updater.app/Contents/MacOS/EPSON Software Updater",
                                               "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon",
                                               "/Volumes/Mac_User_SW/Fiery Master Installer.app/Contents/MacOS/Fiery Master Installer",
                                               "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfManagementService.app/Contents/MacOS/JamfManagementService",
                                               "/Volumes/Fiery Software Manager/Fiery Software Manager.app/Contents/MacOS/Fiery Software Manager",
                                               "/usr/local/jamf/bin/jamf")]
'''

min_endpoint_version = "8.7.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
[[threat.technique.subtechnique]]
id = "T1566.001"
name = "Spearphishing Attachment"
reference = "https://attack.mitre.org/techniques/T1566/001/"



[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"


[[threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"
[[threat.technique.subtechnique]]
id = "T1204.002"
name = "Malicious File"
reference = "https://attack.mitre.org/techniques/T1204/002/"


[[threat.technique]]
id = "T1569"
name = "System Services"
reference = "https://attack.mitre.org/techniques/T1569/"
[[threat.technique.subtechnique]]
id = "T1569.001"
name = "Launchctl"
reference = "https://attack.mitre.org/techniques/T1569/001/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1543"
name = "Create or Modify System Process"
reference = "https://attack.mitre.org/techniques/T1543/"
[[threat.technique.subtechnique]]
id = "T1543.001"
name = "Launch Agent"
reference = "https://attack.mitre.org/techniques/T1543/001/"


[[threat.technique]]
id = "T1547"
name = "Boot or Logon Autostart Execution"
reference = "https://attack.mitre.org/techniques/T1547/"


[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1647"
name = "Plist File Modification"
reference = "https://attack.mitre.org/techniques/T1647/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1082"
name = "System Information Discovery"
reference = "https://attack.mitre.org/techniques/T1082/"


[threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1105"
name = "Ingress Tool Transfer"
reference = "https://attack.mitre.org/techniques/T1105/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "8.7.0"