Elastic Defend high stable eql

Suspicious macOS Application Hidden Executable File

Detects the modification or rename of a hidden executable file in a macOS applications support directory, which contains configuration and resource data for the app. This activity is highly abnormal and could indicate a malicious application or application component such as a 3rd party library.

View Source

Detection Logic

file where event.action in ("modification", "rename") and
 file.Ext.header_bytes like~ ("cffaedfe*", "cafebabe*") and
 file.path like~ ("/Library/Application Support/*", "/Users/*/Library/Application Support/*") and 
 process.executable like~ ("/Applications/*/Contents/MacOS/*", "/Users/*/Applications/*/Contents/MacOS/*") and 
 file.name like~ ".*" and
 not (
  process.code_signature.trusted == true and
  process.code_signature.team_id in ("UBF8T346G9", "MQ55VZLNZQ") and
  file.path like (
    "/Users/*/Library/Application Support/Code - Insiders/User/globalStorage/*/bin/.*",
    "/Users/*/Library/Application Support/Zed/languages/*/.tmp-*"
  )
)

Field Validations

Loading…

Comments (0)

Loading comments...