Elastic Defend high stable eql

Mach-O File with Unusual Extension

Identifies the creation or modification of an Mach-O file with an unexpected file extension. Attackers may attempt to evade detection by masquerading files using the file extension values used by image, audio, or document file types.

View Source

Detection Logic

file where event.action in ("modification", "rename", "open") and

 file.Ext.header_bytes like~ ("cffaedfe*", "cafebabe*") and

 (
   /* common image file extensions */
   file.extension in ("jpg", "jpeg", "emf", "tiff", "gif", "png", "bmp", "fpx", "eps", "svg", "inf") or

   /* common audio and video file extensions */
   file.extension in ("mp3", "wav", "avi", "mpeg", "flv", "wma", "wmv", "mov", "mp4", "3gp") or

   /* common document file extensions */
   file.extension in ("txt", "pdf", "doc", "docx", "rtf", "ppt", "pptx", "xls", "xlsx", "hwp", "html") or

   /* common log, txt and temporary file extensions */
   file.extension in ("log", "conf", "txt", "nib", "ts")
  ) and
  not (process.executable in ("/bin/cp", "/bin/bash") and file.path == "/Library/PrivilegedHelperTools/us.zoom.ZoomDaemon.tmp") and
  not (file.path like~ ("/Users/*/Library/Caches/*", "/private/var/folders/*", "/Library/Application Support/CrashPlan/conf/tmp/*") and file.name : "jna*.tmp") and
  not (process.name in ("javaapplicationstub", "jspawnhelper", "java") and file.name like~ "jna*.tmp") and
  not Effective_process.executable == "/Applications/Cisco Secure Endpoint/Secure Endpoint Service.app/Contents/MacOS/ampdaemon"

Field Validations

Loading…

Comments (0)

Loading comments...