Suspicious Python Package Child Process Execution

[rule]
description = """
Detects the suspicious execution of a suspcious process by a Python package. This activity could indicate the existence
of a malicious Python package installed on the system.
"""
id = "d8cbba0d-7275-4bcd-be22-79ee6fea2951"
license = "Elastic License v2"
name = "Suspicious Python Package Child Process Execution"
os_list = ["macos"]
reference = [
    "https://blog.sonatype.com/new-pymafka-malicious-package-drops-cobalt-strike-on-macos-windows-linux",
]
version = "1.0.23"

query = '''
sequence with maxspan=1m
[process where event.type == "start" and process.name like~ "python*" and process.args like~ "*/lib/python*/site-packages/*" and not
 process.args like~ ("*/lib/python*/site-packages/pip", 
                     "*/lib/python*/site-packages/pipenv/*", 
                     "/Users/*/.platformio/packages/*", 
                     "*/lib/python*/site-packages/pip/*", 
                     "/Applications/*", 
                     "/private/var/folders/*")] by process.entity_id
[process where event.type == "start" and event.action == "exec" and process.parent.name like~ "python*" and 
  (((process.name in ("bash", "sh", "zsh", "dash", "csh", "tcsh", "ksh", "tclsh", "fish") or process.name like "tclsh*") and process.args == "-c" and process.command_line like ("*curl*", "*wget*", "*osascript*", "*whoami*", "*nohup*")) or
  (process.name == "osascript") or (process.name == "curl") or (process.name == "wget") or 
  (process.name == "cp") or (process.name == "mv"))] by process.parent.entity_id
'''

min_endpoint_version = "8.10.2"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"

[[threat.technique.subtechnique]]
id = "T1059.006"
name = "Python"
reference = "https://attack.mitre.org/techniques/T1059/006/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.10.2"