Unsigned or Untrusted Binary Fork via Python


Description

Detects execution of unsigned or untrusted binaries forked by Python processes when the executable path and arguments point to files within user directories. This pattern may indicate malicious Python scripts executing unsigned binaries from compromised user spaces, as observed in APT campaigns like Lazarus Group attacks.

Query · eql

process where event.type == "start" and event.action == "fork" and process.executable like "/Users/*" and 
 (process.code_signature.trusted == false or process.code_signature.exists == false) and 
 process.args_count == 2 and process.args like "/Users/*" and process.args like "/Users/*" and 
 process.parent.name like~ "python*"  and
 not startswith~(process.executable, process.parent.executable)
Raw source Unsigned or Untrusted Binary Fork via Python · Elastic TOML
Esc
Published by elastic/protections-artifacts ↗, licensed under Elastic License 2.0 ↗. Reproduced here unmodified.
[rule]
description = """
Detects execution of unsigned or untrusted binaries forked by Python processes when the executable path and arguments
point to files within user directories. This pattern may indicate malicious Python scripts executing unsigned binaries
from compromised user spaces, as observed in APT campaigns like Lazarus Group attacks.
"""
id = "02e50f28-d5a1-4289-ab49-48ae0e2ca196"
license = "Elastic License v2"
name = "Unsigned or Untrusted Binary Fork via Python"
os_list = ["macos"]
reference = [
    "https://unit42.paloaltonetworks.com/slow-pisces-new-custom-malware/",
    "https://slowmist.medium.com/cryptocurrency-apt-intelligence-unveiling-lazarus-groups-intrusion-techniques-a1a6efda7d34",
]
version = "1.0.4"

query = '''
process where event.type == "start" and event.action == "fork" and process.executable like "/Users/*" and 
 (process.code_signature.trusted == false or process.code_signature.exists == false) and 
 process.args_count == 2 and process.args like "/Users/*" and process.args like "/Users/*" and 
 process.parent.name like~ "python*"  and
 not startswith~(process.executable, process.parent.executable)
'''

min_endpoint_version = "8.16.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.006"
name = "Python"
reference = "https://attack.mitre.org/techniques/T1059/006/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.16.0"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.