Suspicious Dscl Auth Validation

[rule]
description = """
Detects the execution of the Dscl binary with the '-authonly' option set, via an unsigned or untrusted binary. This
allows a username and password to be provided validating that username and password against the directory services on
macOS. Many malware samples will execute this after collecting a users password via some type of prompt in order to
validate the correct password was provided and authenticate them locally without logging in.
"""
id = "4c0a820c-fe42-400b-8b20-57bc7d256f36"
license = "Elastic License v2"
name = "Suspicious Dscl Auth Validation"
os_list = ["macos"]
version = "1.0.11"

query = '''
process where event.type == "start" and event.action == "exec" and process.name == "dscl" and 
 process.args like~ "-authonly" and ((process.parent.code_signature.exists == false or process.parent.code_signature.trusted == false) or process.parent.name in ("sh", "zsh", "bash")) and
 not process.Ext.effective_parent.executable in ("/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon",
                                                 "/Library/csdaemon/csdaemon",
                                                 "/Applications/NinjaRMMAgent/programfiles/ninjarmm-macagent",
                                                 "/usr/bin/dscl",
                                                 "/usr/local/jamf/bin/jamf",
                                                 "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfManagementService.app/Contents/MacOS/JamfManagementService",
                                                 "/Library/Intune/Microsoft Intune Agent.app/Contents/MacOS/IntuneMdmDaemon")
'''

min_endpoint_version = "8.11.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1033"
name = "System Owner/User Discovery"
reference = "https://attack.mitre.org/techniques/T1033/"


[threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[internal]
min_endpoint_version = "8.11.0"