Elastic Defend high stable eql

File Made Executable via Package Install Script

Detects when a file in a suspicious file path is made executable via the chmod binary immediately after an installer pkg is executed via the postinstall script. This is not a common occurrence and indicates the installation of a malicious binary.

View Source

Detection Logic

sequence by process.parent.pid with maxspan=30s
[process where event.type == "start" and event.action == "fork" and 
    process.name like~ ("bash", "zsh", "sh", "python*", "tclsh*", "dash", "csh", "tcsh", "ksh", "fish") and
    process.args like~ "/tmp/PKInstallSandbox.*/Scripts/*/postinstall" and 
    process.args like ("/Users/*", "/Volumes/*") and 
    not process.args like "/Applications/Adobe Acrobat DC"]
[process where event.type == "start" and event.action == "exec" and 
    process.name == "chmod" and 
    process.args in ("+x", "a+x", "0777", "777") and
    process.args like~ ("/private/tmp/*", 
                        "/var/tmp/*", 
                        "/var/lib/*",
                        "/tmp/*", 
                        "/var/folders/*", 
                        "/Users/Shared/*", 
                        "/Library/Containers/*", 
                        "/Users/*/Library/*",
                        "/Users/*/Applications/*",
                        "/var/root/*", 
                        "/Library/WebServer/*",
                        "/Library/Fonts/*",
                        "/usr/local/bin/*") and
    process.parent.name like~ ("bash", "zsh", "sh", "python*", "tclsh*", "osascript", "dash", "csh", "tcsh", "ksh", "fish") and not
    process.command_line == "chmod +x decompress"]

Field Validations

Loading…

Comments (0)

Loading comments...