Elastic Defend high stable eql

Suspicious Codesign Execution via Osacompile

Detects the abnormal execution of the codesign binary via Osacompile to forcefully sign all contents of a bundle. Threat actors may use this technique to bypass code signing requirements.

View Source

Detection Logic

process where event.type == "start" and event.action == "exec" and 
 process.name == "codesign" and
 process.args in ("--sign", "-s") and
 process.args in ("--force", "-f") and
 process.args in ("--deep") and
 ((process.parent.name == "osacompile") or (process.parent.name in ("bash", "sh", "zsh") and process.Ext.effective_parent.name like~ ("terminal", "codesign"))) and
 not process.Ext.effective_parent.executable like~ "/Volumes/PostgreSQL*/postgresql*.app/Contents/MacOS/PostgreSQL"

Field Validations

Loading…

Comments (0)

Loading comments...