Suspicious PrivilegedHelperTool Activity

[rule]
description = """
Detects the potential abuse of a PrivilegedHelperTool by triggering on the execution of specific system binaries where
the parent process is a privilegedhelpertool. This activity is not normal or common and could indicate a
privilegedhelpertool exploitation bypass attempt. PrivilegedHelperTools are sometimes targeted via injection and XPC
manipulation to bypass macOS security controls in order to elevate privileges, establish privileged persistence, or
execute commands as a privileged user.
"""
id = "900fdb84-2a81-4a6d-88db-b48a0fafd79e"
license = "Elastic License v2"
name = "Suspicious PrivilegedHelperTool Activity"
os_list = ["macos"]
reference = ["https://wojciechregula.blog/post/bypass-tcc-via-privileged-helpers-aka-cve-2020-10008/"]
version = "1.0.27"

query = '''
process where event.type == "start" and 
  event.action ==  "exec" and user.name == "root" and 
  process.parent.executable like "/Library/PrivilegedHelperTools/*" and 
  (
    /* shell and common lolbins */
   (((process.name like~ ("bash", "zsh", "sh", "tclsh*") and process.args == "-c" and process.args like~ ("/tmp/*",
                                                                                                 "*/bin/curl *",
                                                                                                 "*/bin/nscurl*", 
                                                                                                 "*/bin/osascript *",
                                                                                                 "*/bin/python*",
                                                                                                 "osascript*",
                                                                                                 "python*",
                                                                                                 "curl*")) or 
      process.name like~ ("python*", "tclsh*", "osascript", "osacompile", "curl", "nscurl", "wget", "tccd")) and not
      process.command_line like~ ("*remove*", "*unload*", "*/Library/Application Support/JAMF/Composer/Sources/*", "*https://www.google.com*")) or   
   /* unsigned or untrusted macO */
   (process.code_signature.exists == false or process.code_signature.trusted == false) 
  ) and not
  process.executable like ("/Library/PrivilegedHelperTools/*", "/Applications/*") and not
  process.parent.executable == "/Library/PrivilegedHelperTools/com.kaseya.VSAHelper" and not
  (process.parent.code_signature.trusted == true and process.parent.code_signature.exists == true)
'''

min_endpoint_version = "8.11.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1068"
name = "Exploitation for Privilege Escalation"
reference = "https://attack.mitre.org/techniques/T1068/"


[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[internal]
min_endpoint_version = "8.11.0"