Unusual Launch Service Creation via Unsigned or Untrusted Binary

[rule]
description = """
Detects when an unsigned or untrusted binary creates a launch service where the `keepalive` and `runatload` values are
set to `true` and the program arguments are missing. A recent Nim compiled piece of malware was observed doing this in
order to persist past reboots.
"""
id = "ed6568e0-17d3-4753-bb34-9f86d62acccb"
license = "Elastic License v2"
name = "Unusual Launch Service Creation via Unsigned or Untrusted Binary"
os_list = ["macos"]
reference = ["https://x.com/moonlock_lab/status/1881669277016793184"]
version = "1.0.4"

query = '''
persistence where event.action == "launch_daemon" and (process.code_signature.trusted == false or process.code_signature.exists == false) and 
 (Persistence.keepalive == true and Persistence.runatload == true) and Persistence.args == null
'''

min_endpoint_version = "8.11.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1543"
name = "Create or Modify System Process"
reference = "https://attack.mitre.org/techniques/T1543/"
[[threat.technique.subtechnique]]
id = "T1543.001"
name = "Launch Agent"
reference = "https://attack.mitre.org/techniques/T1543/001/"

[[threat.technique.subtechnique]]
id = "T1543.004"
name = "Launch Daemon"
reference = "https://attack.mitre.org/techniques/T1543/004/"


[[threat.technique]]
id = "T1547"
name = "Boot or Logon Autostart Execution"
reference = "https://attack.mitre.org/techniques/T1547/"


[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1647"
name = "Plist File Modification"
reference = "https://attack.mitre.org/techniques/T1647/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.11.0"