Detection rules › Elastic

Unsigned or Untrusted Binary Fork via Python

Source
github.com/elastic/protections-artifacts

Detects execution of unsigned or untrusted binaries forked by Python processes when the executable path and arguments point to files within user directories. This pattern may indicate malicious Python scripts executing unsigned binaries from compromised user spaces, as observed in APT campaigns like Lazarus Group attacks.

MITRE ATT&CK coverage

Telemetry coverage

Rule body

[rule]
description = """
Detects execution of unsigned or untrusted binaries forked by Python processes when the executable path and arguments
point to files within user directories. This pattern may indicate malicious Python scripts executing unsigned binaries
from compromised user spaces, as observed in APT campaigns like Lazarus Group attacks.
"""
id = "02e50f28-d5a1-4289-ab49-48ae0e2ca196"
license = "Elastic License v2"
name = "Unsigned or Untrusted Binary Fork via Python"
os_list = ["macos"]
reference = [
    "https://unit42.paloaltonetworks.com/slow-pisces-new-custom-malware/",
    "https://slowmist.medium.com/cryptocurrency-apt-intelligence-unveiling-lazarus-groups-intrusion-techniques-a1a6efda7d34",
]
version = "1.0.4"

query = '''
process where event.type == "start" and event.action == "fork" and process.executable like "/Users/*" and 
 (process.code_signature.trusted == false or process.code_signature.exists == false) and 
 process.args_count == 2 and process.args like "/Users/*" and process.args like "/Users/*" and 
 process.parent.name like~ "python*"  and
 not startswith~(process.executable, process.parent.executable)
'''

min_endpoint_version = "8.16.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.006"
name = "Python"
reference = "https://attack.mitre.org/techniques/T1059/006/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.16.0"

Stages and Predicates

Stage 1: process

process where event.type == "start" and event.action == "fork" and process.executable like "/Users/*" and 
 (process.code_signature.trusted == false or process.code_signature.exists == false) and 
 process.args_count == 2 and process.args like "/Users/*" and process.args like "/Users/*" and 
 process.parent.name like~ "python*"  and
 not startswith~(process.executable, process.parent.executable)

Exclusions

The rule actively suppresses these predicates.

FieldKindExcluded valuesSearch
process.executablestarts_withprocess.parent.executableexcludes:process.executable field:"process.executable" value:"process.parent.executable"

Indicators

These rows show field, operator, and value matches.