Elastic Defend high stable eql

Suspicious Archive Creation via Ditto

Detects the use of the Ditto utility on macOS to create a compressed archive. The AMOS stealer has used this lesser known method for creating an archive containing the collected data for exfiltration via C2.

View Source

Detection Logic

process where event.type == "start" and event.action == "exec" and process.name == "ditto" and
 process.args in~ ("-c", "-k", "--sequesterRsrc", "--keepParent") and
 process.args like ("/Users/*", "/private/tmp/*", "/tmp/*", "/var/folders/*") and
 process.args like~ "*.zip*" and
 (process.parent.code_signature.exists == false or process.parent.code_signature.trusted == false) and
 not process.parent.executable like ("/opt/homebrew/*", "/usr/local/Cellar/*", "/usr/local/Homebrew/*") and 
 not process.Ext.effective_parent.executable like ("/Library/Intune/Microsoft Intune Agent.app/Contents/MacOS/IntuneMdmDaemon",
                                                  "/opt/homebrew/*",
                                                  "/Applications/Ghostty.app/Contents/MacOS/ghostty")

Field Validations

Loading…

Comments (0)

Loading comments...