Detection rules › Elastic
Unsigned or Untrusted Binary Fork via Python
Detects execution of unsigned or untrusted binaries forked by Python processes when the executable path and arguments point to files within user directories. This pattern may indicate malicious Python scripts executing unsigned binaries from compromised user spaces, as observed in APT campaigns like Lazarus Group attacks.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution |
Telemetry coverage
| Platform | Record / event type |
|---|---|
| macOS | ESF event fork (NOTIFY): Fires after fork(2) or vfork(2) creates a child process. |
Rule body
[rule]
description = """
Detects execution of unsigned or untrusted binaries forked by Python processes when the executable path and arguments
point to files within user directories. This pattern may indicate malicious Python scripts executing unsigned binaries
from compromised user spaces, as observed in APT campaigns like Lazarus Group attacks.
"""
id = "02e50f28-d5a1-4289-ab49-48ae0e2ca196"
license = "Elastic License v2"
name = "Unsigned or Untrusted Binary Fork via Python"
os_list = ["macos"]
reference = [
"https://unit42.paloaltonetworks.com/slow-pisces-new-custom-malware/",
"https://slowmist.medium.com/cryptocurrency-apt-intelligence-unveiling-lazarus-groups-intrusion-techniques-a1a6efda7d34",
]
version = "1.0.4"
query = '''
process where event.type == "start" and event.action == "fork" and process.executable like "/Users/*" and
(process.code_signature.trusted == false or process.code_signature.exists == false) and
process.args_count == 2 and process.args like "/Users/*" and process.args like "/Users/*" and
process.parent.name like~ "python*" and
not startswith~(process.executable, process.parent.executable)
'''
min_endpoint_version = "8.16.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.006"
name = "Python"
reference = "https://attack.mitre.org/techniques/T1059/006/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[internal]
min_endpoint_version = "8.16.0"
Stages and Predicates
Stage 1: process
process where event.type == "start" and event.action == "fork" and process.executable like "/Users/*" and
(process.code_signature.trusted == false or process.code_signature.exists == false) and
process.args_count == 2 and process.args like "/Users/*" and process.args like "/Users/*" and
process.parent.name like~ "python*" and
not startswith~(process.executable, process.parent.executable)
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
process.executable | starts_with | process.parent.executable | excludes:process.executable field:"process.executable" value:"process.parent.executable" |
Indicators
These rows show field, operator, and value matches.