Elastic medium stable eql

Suspicious macOS MS Office Child Process

Identifies suspicious child processes of frequently targeted Microsoft Office applications (Word, PowerPoint, and Excel). These child processes are often launched during exploitation of Office applications or by documents with malicious macros.

View Source

Detection Logic

process where event.action == "exec" and host.os.type == "macos" and
    process.parent.name: (
      "Microsoft Word",
      "Microsoft Outlook",
      "Microsoft Excel",
      "Microsoft PowerPoint",
      "Microsoft OneNote"
    ) and
  process.name : (
    "curl",
    "nscurl",
    "bash",
    "sh",
    "osascript",
    "python*",
    "perl*",
    "mktemp",
    "chmod",
    "php",
    "nohup",
    "openssl",
    "plutil",
    "PlistBuddy",
    "xattr",
    "mktemp",
    "sqlite3",
    "funzip",
    "popen"
  ) and

  // Filter FPs related to product version discovery and Office error reporting behavior
  not process.args:
    (
      "ProductVersion",
      "hw.model",
      "ioreg",
      "ProductName",
      "ProductUserVisibleVersion",
      "ProductBuildVersion",
      "/Library/Application Support/Microsoft/MERP*/Microsoft Error Reporting.app/Contents/MacOS/Microsoft Error Reporting",
      "open -a Safari *",
      "defaults read *",
      "sysctl hw.model*",
      "ioreg -d2 -c IOPlatformExpertDevice *",
      "ps aux
| grep 'ToDesk_Desktop'
| grep -v grep",
      "PIPE=\"$CFFIXED_USER_HOME/.zoteroIntegrationPipe*"
    ) and

   not process.parent.executable :
        (
          "/Applications/ToDesk.app/Contents/MacOS/ToDesk_Service",
          "/usr/local/Privacy-i/PISupervisor",
          "/Library/Addigy/lan-cache",
          "/Library/Elastic/Agent/*",
          "/opt/jc/bin/jumpcloud-agent",
          "/usr/sbin/networksetup"
        ) and
   not (process.name : "sh" and process.command_line : "*$CFFIXED_USER_HOME/.zoteroIntegrationPipe*") and

   not process.Ext.effective_parent.executable : (
        "/Applications/ToDesk.app/Contents/MacOS/ToDesk_Service",
        "/usr/local/Privacy-i/PISupervisor",
        "/Library/Addigy/auditor",
        "/Library/Elastic/Agent/*",
        "/opt/jc/bin/jumpcloud-agent",
        "/usr/sbin/networksetup"
      ) and
    not (
      process.name in ("sh", "bash") and
      process.command_line like "*com.microsoft.Outlook/Data/tmp/Outlook*Temp*" and
      process.parent.executable in (
        "/Applications/Microsoft Outlook.app/Contents/MacOS/Microsoft Outlook",
        "/Applications/Microsoft Outlook 2.app/Contents/MacOS/Microsoft Outlook",
        "/Applications/Microsoft/Microsoft Outlook.app/Contents/MacOS/Microsoft Outlook"
      )
    )

Field Validations

Loading…

Comments (0)

Loading comments...