Elastic Defend high stable eql

Suspicious PrivilegedHelperTool Activity

Detects the potential abuse of a PrivilegedHelperTool by triggering on the execution of specific system binaries where the parent process is a privilegedhelpertool. This activity is not normal or common and could indicate a privilegedhelpertool exploitation bypass attempt. PrivilegedHelperTools are sometimes targeted via injection and XPC manipulation to bypass macOS security controls in order to elevate privileges, establish privileged persistence, or execute commands as a privileged user.

View Source

Detection Logic

process where event.type == "start" and 
  event.action ==  "exec" and user.name == "root" and 
  process.parent.executable like "/Library/PrivilegedHelperTools/*" and 
  (
    /* shell and common lolbins */
   (((process.name like~ ("bash", "zsh", "sh", "tclsh*") and process.args == "-c" and process.args like~ ("/tmp/*",
                                                                                                 "*/bin/curl *",
                                                                                                 "*/bin/nscurl*", 
                                                                                                 "*/bin/osascript *",
                                                                                                 "*/bin/python*",
                                                                                                 "osascript*",
                                                                                                 "python*",
                                                                                                 "curl*")) or 
      process.name like~ ("python*", "tclsh*", "osascript", "osacompile", "curl", "nscurl", "wget", "tccd")) and not
      process.command_line like~ ("*remove*", "*unload*", "*/Library/Application Support/JAMF/Composer/Sources/*", "*https://www.google.com*")) or   
   /* unsigned or untrusted macO */
   (process.code_signature.exists == false or process.code_signature.trusted == false) 
  ) and not
  process.executable like ("/Library/PrivilegedHelperTools/*", "/Applications/*") and not
  process.parent.executable == "/Library/PrivilegedHelperTools/com.kaseya.VSAHelper" and not
  (process.parent.code_signature.trusted == true and process.parent.code_signature.exists == true)

Field Validations

Loading…

Comments (0)

Loading comments...