Unsigned or Untrusted PyInstaller Binary Execution

[rule]
description = """
Detects unsigned or untrusted PyInstaller binaries creating _MEI zip files in temporary directories. Threat actors use
PyInstaller to package malware with Python interpreters for execution on systems without Python.
"""
id = "27243b25-8465-4fa5-8c9a-470deeb4d503"
license = "Elastic License v2"
name = "Unsigned or Untrusted PyInstaller Binary Execution"
os_list = ["macos"]
reference = ["https://www.jamf.com/blog/pyinstaller-malware-jamf-threat-labs/"]
version = "1.0.4"

query = '''
file where event.action == "modification" and file.extension == "zip" and 
 file.path like ("/private/tmp/_MEI*", "/tmp/_MEI*") and 
 (process.code_signature.trusted == false or process.code_signature.exists == false) and
 not process.executable like "/opt/homebrew/*"
'''

min_endpoint_version = "8.16.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "Effective_process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.006"
name = "Python"
reference = "https://attack.mitre.org/techniques/T1059/006/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.16.0"