Suspicious XPC Service Child Process

[rule]
description = "Detects an abnormal child process of a XPC service running from a suspicious location."
id = "fdb36c69-9a1d-4ab3-863d-91b3301b6c6d"
license = "Elastic License v2"
name = "Suspicious XPC Service Child Process"
os_list = ["macos"]
reference = [
    "https://attack.mitre.org/techniques/T1559/003/",
    "https://attack.mitre.org/techniques/T1059/004/",
    "https://objective-see.org/blog/blog_0x59.html",
]
version = "1.0.27"

query = '''
process where event.type == "start" and process.parent.name : "com.*" and 
    ((process.name in ("bash", "sh", "zsh") and process.args == "-c") or
    process.name like~ ("curl", "nscurl", "osascript", "python*", "tclsh*")) and not
    process.executable like "/Applications/*" and not 
    process.parent.executable like~ 
                                ("/Applications/*", 
                                 "/Library/PrivilegedHelperTools/*", 
                                 "/System/*", 
                                 "/private/var/db/com.apple.xpc.*", 
                                 "/private/var/folders/*/*/*/AppTranslocation/*",
                                 "/Library/Application Support/AvastHUB/com.avast.hub.app/Contents/Helpers/com.avast.hub.worker",
                                 "/Library/Application Support/Symantec/Silo/MES/LiveUpdate/com.symantec.SymLUHelper",
                                 "/Library/Application Support/Symantec/Silo/NFM/LiveUpdate/com.symantec.SymLUHelper",
                                 "/Library/Application Support/AvastSecureLine/components/update/com.avast.osx.secureline.update-agent",
                                 "/Library/Application Support/CatoNetworks/com.catonetworks.mac.CatoClient.helper.app/Contents/MacOS/com.catonetworks.mac.CatoClient.helper",
                                 "/usr/libexec/*", 
                                 "/Library/SystemExtensions/*") and not 
    process.parent.name like~ ("com.docker.*", "com.todyl.SGNWatchDog") and not
    process.command_line like~ ("sh -c /bin/cp /Library/Preferences/SystemConfiguration/preferences.plist /Library/Preferences/SystemConfiguration/preferences.plist.old",
                               "/bin/sh -c git-upload-pack*", "*sh -c */Library/Application Support/HmaProVpn/hub/userinit.sh*") and 
    not process.Ext.effective_parent.executable == "/Library/Application Support/PasswordManager/com.trendmicro.consumer.pwmsvc" and
    not (process.parent.code_signature.trusted == true and process.parent.code_signature.exists == true) and
    not (
      process.parent.executable == "/Library/AppQuest/com.apple.questd" and
      process.Ext.effective_parent.executable == "/usr/bin/sudo"
    )
'''

min_endpoint_version = "8.11.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"


[[threat.technique]]
id = "T1559"
name = "Inter-Process Communication"
reference = "https://attack.mitre.org/techniques/T1559/"
[[threat.technique.subtechnique]]
id = "T1559.003"
name = "XPC Services"
reference = "https://attack.mitre.org/techniques/T1559/003/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.11.0"