locate-shlayer-payload-decryption-activity

id: d405146b-47a7-4bcf-b2c5-ccf8a2db9a1d
name: locate-shlayer-payload-decryption-activity
description: |
  This query was originally published in the threat analytics report, OSX/Shlayer sustains adware push.
  Shlayer is adware that spies on users' search terms, and redirects network traffic to serve the user attacker-controlled search results containing ads.
  The following query locates activity associated with the Shlayer payload decrypter.
  Reference - https://www.intego.com/mac-security-blog/osxshlayer-new-mac-malware-comes-out-of-its-shell/
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Execution
query: |
  // Find use of the Shlayer OpenSSL command to decode and decrypt a payload
  DeviceProcessEvents
  | where Timestamp > ago(7d)
  | where FileName =~ "openssl"
  and ProcessCommandLine has "-base64" and
  ProcessCommandLine has "-out"  and
  ProcessCommandLine has "-nosalt"
  and ProcessCommandLine has_any("-aes256", "-aes-256")