Decoded or Decrypted Payload Written to Suspicious Directory

[rule]
description = """
Identifies when the openssl utility is used to decode and/or decrypt a payload and write it to an abnormal or suspicious
directory. Malware authors may attempt to evade detection by encoding and/or encrypting their payload. This behavior is
consistent with the Bundlore malware family.
"""
id = "4dd92062-2871-43bc-adda-82f15cf6e189"
license = "Elastic License v2"
name = "Decoded or Decrypted Payload Written to Suspicious Directory"
os_list = ["macos"]
reference = ["https://attack.mitre.org/software/S0482/"]
version = "1.0.30"

query = '''
process where event.action == "exec" and
  ((process.name == "openssl" and process.args like~ "-out" and process.args like~ "enc" and process.args in ("-d", "-base64") and
    process.args like~ ("/tmp/*", 
                        "/Users/*/.*",
                        "/Applications/*/.*",
                        "/private/tmp/*", 
                        "/var/tmp/*", 
                        "/var/folders/*", 
                        "/Users/Shared/*",
                        "/Library/Graphics/*",
                        "/Users/*/Library/Preferences/*",
                        "/Users/*/Library/Services/*", 
                        "/Library/Containers/*", 
                        "/var/root/*", 
                        "/var/lib/*",
                        "/Library/WebServer/*",
                        "/Library/Fonts/*")) or 
   (process.name == "base64" and process.args == "-d" and 
    process.args like~ ("/tmp/*", 
                        "*/.*",
                        "/private/tmp/*", 
                        "/var/tmp/*", 
                        "/var/folders/*", 
                        "/Users/Shared/*", 
                        "/Library/Graphics/*",
                        "/Users/*/Library/Preferences/*",
                        "/Users/*/Library/Services/*", 
                        "/Library/Containers/*", 
                        "/var/root/*", 
                        "/var/lib/*",
                        "/Library/WebServer/*",
                        "/Library/Fonts/*")))
'''

min_endpoint_version = "8.10.2"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"


[[threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"
[[threat.technique.subtechnique]]
id = "T1204.002"
name = "Malicious File"
reference = "https://attack.mitre.org/techniques/T1204/002/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1027"
name = "Obfuscated Files or Information"
reference = "https://attack.mitre.org/techniques/T1027/"

[[threat.technique]]
id = "T1140"
name = "Deobfuscate/Decode Files or Information"
reference = "https://attack.mitre.org/techniques/T1140/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.2"