Unusually large OSA script execution via Shell Command

[rule]
description = """
Detects when an unusually large OSA script is executed by Osascript via a shell command. This specific invocation of an
OSA script is unique and very suspicious if not malicious. Recently this method of executing OSA script has been
observed being used by many different stealer samples. These stealers will include the malicious OSA script in their
binary, usually encoded, then execute it via the default shell.
"""
id = "62a95b02-de9b-41b0-acbf-5589fadcfbe6"
license = "Elastic License v2"
name = "Unusually large OSA script execution via Shell Command"
os_list = ["macos"]
reference = [
    "https://www.virustotal.com/gui/file/748a7efffe738497c188b44c09335da7f93683a7bf0bc2dacc0f08783b03ce8b",
]
version = "1.0.7"

query = '''
sequence with maxspan=5s
[process where event.type == "start" and event.action == "exec" and (process.name in ("bash", "sh", "zsh", "dash", "csh", "tcsh", "ksh", "tclsh", "fish") or process.name like "tclsh*") and
  process.args == "-c" and process.args_count == 3] by process.entity_id
[process where event.type == "start" and event.action == "exec" and process.name == "osascript" and 
  process.args == "-e" and process.args_count == 3 and
  process.command_line == null] by process.parent.entity_id
'''

min_endpoint_version = "8.11.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.002"
name = "AppleScript"
reference = "https://attack.mitre.org/techniques/T1059/002/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.11.0"