locate-surfbuyer-downloader-decoding-activity

id: 1f60df62-6551-48f6-8e65-64f61ff43def
name: locate-surfbuyer-downloader-decoding-activity
description: |
  This query was originally published in the threat analytics report, OSX/SurfBuyer adware campaign.
  It will return results if a shell script has furtively attempted to decode and save a file to a /tmp folder.
  If discovered on your system, this kind of activity might be associated with SurfBuyer, which is adware that installs a browser extension to take control of several major web browsers, including Safari, Google Chrome, and Firefox.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Execution
query: |
  // Find SurfBuyer command to decode a file and save it into a /tmp folder using a certain file name
  DeviceProcessEvents
  // Check for activity over the past 7 days
  | where Timestamp > ago(7d)
  | where ProcessCommandLine has "base64" and ProcessCommandLine has "/tmp/e_"