Reflective Binary Load

[rule]
description = """
Detects reflective code loading on macOS through creation of "NSCreateObjectFileImageFromMemory-*" temporary files by
suspicious processes. This technique allows malware to execute in-memory Mach-O binaries while evading disk-based
detection.
"""
id = "16fba7a9-f8f6-43ce-ae24-6a392a48e49c"
license = "Elastic License v2"
name = "Reflective Binary Load"
os_list = ["macos"]
reference = [
    "https://slyd0g.medium.com/understanding-and-defending-against-reflective-code-loading-on-macos-e2e83211e48f",
    "https://github.com/slyd0g/SwiftInMemoryLoading",
]
version = "1.0.54"

query = '''
file where event.type != "deletion" and 
 file.name : "NSCreateObjectFileImageFromMemory-*" and 
 process.name != null and
 process.executable != null and
 ((process.code_signature.trusted == false or process.code_signature.exists == false) or
  process.name like~ ("osascript", "bash", "sh", "zsh", "node")) and
 not (process.executable like "/private/tmp/*" and process.name == "osx-x86_64") and
 not (process.code_signature.exists == true and process.code_signature.trusted == true and process.code_signature.team_id == "EBNT3ZX97E") and
 not process.executable like~ "/private/tmp/PKInstallSandbox.*" and
 not process.code_signature.signing_id == "com.steinberg.cubase13" and
 not Effective_process.executable in ("/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon",
                                      "/Applications/iZotope Product Portal.app/Contents/MacOS/Product Portal",
                                      "/Library/Application Support/Mosyle/MosyleMDM.app/Contents/MacOS/MosyleMDM",
                                      "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfManagementService.app/Contents/MacOS/JamfManagementService",
                                      "/Library/Kandji/Kandji Agent.app/Contents/Helpers/Kandji Library Manager.app/Contents/MacOS/kandji-library-manager",
                                      "/Library/Intune/Microsoft Intune Agent.app/Contents/MacOS/IntuneMdmDaemon") and
 not Effective_process.executable like "/usr/local/rippling/*"
'''

min_endpoint_version = "8.11.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1106"
name = "Native API"
reference = "https://attack.mitre.org/techniques/T1106/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1620"
name = "Reflective Code Loading"
reference = "https://attack.mitre.org/techniques/T1620/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.11.0"