Elastic Defend high stable eql

Payload Decoded and Decrypted via Built-In Utilities

Identifies when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.

View Source

Detection Logic

process where event.action == "exec" and process.name == "openssl" and
 process.args like~ "enc" and
    // openssl base64-decoding data
    process.args like~ "-base64" and
    // openssl decrypting input data
    process.args == "-d" and
    process.args_count > 4 and
 not process.Ext.effective_parent.executable like ("/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon",
                                                   "/Applications/iTerm.app/Contents/MacOS/iTerm2",
                                                   "/usr/local/jamf/bin/jamf",
                                                   "/Library/Addigy/go-agent")

Field Validations

Loading…

Comments (0)

Loading comments...