Payload Delivery via Curl and Immediate Execution

[rule]
description = """
Detects when an executable file is created by Curl, immediately made executable by Chmod and executed all within a 15
second timespan by the same parent process. This will detect attempts to gain initial access via shell scripts and
automated one line commands.
"""
id = "ab583372-b42e-4e5e-8e3a-fc900de0c34e"
license = "Elastic License v2"
name = "Payload Delivery via Curl and Immediate Execution"
os_list = ["macos"]
version = "1.0.6"

query = '''
sequence by process.parent.entity_id with maxspan=15s
[process where event.type == "start" and event.action == "exec" and process.name in ("curl", "nscurl") and
  process.args in ("-o", "--output") and
  not process.command_line : ("*https://raw.githubusercontent.com*", "*https://github.com*")]
[process where event.type == "start" and event.action == "exec" and process.name == "chmod" and process.args in ("+x", "777")]
[process where event.type == "start" and event.action == "exec" and (process.code_signature.trusted == false or process.code_signature.exists == false) and 
  not process.executable like ("/opt/homebrew/*", "/usr/local/Cellar/*")]
'''

min_endpoint_version = "8.16.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 2

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1105"
name = "Ingress Tool Transfer"
reference = "https://attack.mitre.org/techniques/T1105/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "8.16.0"