Elastic Defend high stable eql
Initial Access via macOS Installer Package
Identifies when a macOS installer package is executed followed by the execution of a utility that's commonly used by attackers when downloading a payload, establishing persistence, profiling an endpoint, or decompressing/decoding a file before execution. An attacker may configure an installer package to download an additional payload or malware for execution to gain initial access or establish persistence on an endpoint.
Detection Logic
sequence with maxspan=1m
[process where event.action == "exec" and process.name in ("installer", "package_script_service") and not
process.args like~
("/Library/Application Support/JAMF/Downloads/*",
"/tmp/KSInstallAction.*",
"/tmp/FLEXnet",
"./Epson Scanner Monitor.pkg",
"./Epson Event Manager.pkg",
"./Epson Scanner ICA Driver.pkg",
"/tmp/PKInstallSandbox.*/Scripts/com.epson.pkg.eventmanager.*/Epson Scanner Monitor.pkg",
"/Library/Addigy/ansible/packages/TeamViewer Host */TeamViewer_Host.pkg") and not
process.parent.executable like~ ("/usr/local/ltechagent/ltupdate",
"/sbin/launchd",
"/Users/*/Library/Caches/*",
"/Library/PrivilegedHelperTools/*",
"/Applications/Epson Software/EPSON Software Updater.app/Contents/MacOS/EPSON Software Updater",
"/private/var/folders/*/download/ARMDCHammer") and not
process.Ext.effective_parent.executable in ("/usr/local/jamf/bin/jamf",
"/Library/Intune/Microsoft Intune Agent.app/Contents/MacOS/IntuneMdmDaemon",
"/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon",
"/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfManagementService.app/Contents/MacOS/JamfManagementService",
"/Volumes/Fiery Software Manager/Fiery Software Manager.app/Contents/MacOS/Fiery Software Manager")]
[process where event.action in ("exec", "fork") and
// Descendant of macOS installer process
descendant of [
process where event.action == "exec" and
process.name in ("Installer", "package_script_service") and not
process.args like~
("/Library/Application Support/JAMF/Downloads/*",
"/tmp/KSInstallAction.*",
"/tmp/PKInstallSandbox.*/Scripts/com.epson.pkg.eventmanager.*/Epson Scanner Monitor.pkg",
"./Epson Scanner Monitor.pkg",
"/tmp/FLEXnet",
"/Library/Preferences/com.epson.Epson Scan OCR Component Pro.XmlType.UnInstallList.plist",
"./Epson Event Manager.pkg",
"./Epson Scanner ICA Driver.pkg",
"/Library/Addigy/ansible/packages/TeamViewer Host */TeamViewer_Host.pkg") and not
process.parent.executable like~
("/usr/local/ltechagent/ltupdate",
"/sbin/launchd",
"/Users/*/Library/Caches/*",
"/Applications/Epson Software/EPSON Software Updater.app/Contents/MacOS/EPSON Software Updater",
"/Library/PrivilegedHelperTools/*",
"/private/var/folders/*/download/ARMDCHammer") and not
process.Ext.effective_parent.executable in ("/usr/local/jamf/bin/jamf",
"/Library/Intune/Microsoft Intune Agent.app/Contents/MacOS/IntuneMdmDaemon",
"/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon",
"/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfManagementService.app/Contents/MacOS/JamfManagementService",
"/Volumes/Mac_User_SW/Fiery Master Installer.app/Contents/MacOS/Fiery Master Installer",
"/Volumes/Fiery Software Manager/Fiery Software Manager.app/Contents/MacOS/Fiery Software Manager")
] and
(
// curl scope limited to silver-sparrows to reduce noise
(process.name in ("curl", "nscurl") and process.command_line : ("*.amazonaws.com*",
"*.cloudfront.net*",
"*raw.githubusercontent.com*")) or
// No hang up executed with a bash command
(process.name == "nohup" and process.command_line : "* &") or
// Open SSL used to encrypt or encode/decode data
(process.name == "openssl" and process.args : ("-base64", "-enc")) or
// Base64 used to decode data
(process.name == "base64" and process.args : "-d") or
// chmod used to make files readable, writable and executable by all users
(process.name == "chmod" and process.args : ("+x", "a+x", "0777", "755", "777") and process.args : "/tmp/*" and
not process.args : ("/tmp/com.adobe.acrobat.DC", "/tmp/FLEXnet")) or
// xattr used to change extended attributes for a file
(process.name == "xattr" and ((process.args : "com.apple.quarantine" and
process.args : ("-d", "-w", "-?d", "-?w")) or
(process.args == "-c")) and process.args : "/tmp/*") or
(process.name == "touch" and process.args : "/tmp/*") or
(process.name in ("bash", "sh", "zsh") and process.args == "-c" and process.args : ("*/bin/curl*.amazonaws.com*",
"*/bin/curl*.cloudfront.net*",
"*/bin/curl*raw.githubusercontent.com*",
"*/bin/osascript*",
"*/bin/wget*",
"*/bin/chmod +x*",
"*/bin/plutil*-convert*",
"*/bin/openssl*-enc*",
"*/bin/openssl*-base64*",
"*/bin/base64*-d*",
"*/bin/xattr*com.apple.quarantine*",
"*/bin/touch /tmp/*"))
) and
not process.parent.executable : ("/sbin/launchd",
"/Users/*/Library/Caches/*",
"/Library/PrivilegedHelperTools/*",
"/private/var/folders/*/download/ARMDCHammer") and not
process.Ext.effective_parent.executable in ("/Applications/Epson Software/EPSON Software Updater.app/Contents/MacOS/EPSON Software Updater",
"/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon",
"/Volumes/Mac_User_SW/Fiery Master Installer.app/Contents/MacOS/Fiery Master Installer",
"/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfManagementService.app/Contents/MacOS/JamfManagementService",
"/Volumes/Fiery Software Manager/Fiery Software Manager.app/Contents/MacOS/Fiery Software Manager",
"/usr/local/jamf/bin/jamf")]Field Validations
Loading…
Comments (0)
Loading comments...