NotificationCenter Silenced via Killall Binary


Description

Detects when the killall process is spawned in order to kill NotificationCenter messages that provide users with pop up system notifications like security warnings etc.

Query · eql

process where event.type == "start" and event.action == "exec" and process.name == "killall" and
 process.args like "NotificationCenter" and
 (process.parent.executable like ("/Applications/*", "/Volumes/*", "/Users/*", "/private/tmp/*", "/tmp/*") or
  process.Ext.effective_parent.executable like ("/Applications/*", "/Volumes/*", "/Users/*", "/private/tmp/*", "/tmp/*")) and
  not (process.parent.code_signature.trusted == true and process.parent.code_signature.team_id in ("8CA6NAN723", "Y75Z7G683Y", "7JVNAY4725")) and
  not process.Ext.effective_parent.executable == "/Applications/Airtame.app/Contents/MacOS/Airtame"
Raw source NotificationCenter Silenced via Killall Binary · Elastic TOML
Esc
Published by elastic/protections-artifacts ↗, licensed under Elastic License 2.0 ↗. Reproduced here unmodified.
[rule]
description = """
Detects when the killall process is spawned in order to kill NotificationCenter messages that provide users with pop up
system notifications like security warnings etc.
"""
id = "5399e933-d4d7-47e5-a816-5d850729c26c"
license = "Elastic License v2"
name = "NotificationCenter Silenced via Killall Binary"
os_list = ["macos"]
reference = ["https://securelist.com/new-macos-backdoor-crypto-stealer/111778/"]
version = "1.0.6"

query = '''
process where event.type == "start" and event.action == "exec" and process.name == "killall" and
 process.args like "NotificationCenter" and
 (process.parent.executable like ("/Applications/*", "/Volumes/*", "/Users/*", "/private/tmp/*", "/tmp/*") or
  process.Ext.effective_parent.executable like ("/Applications/*", "/Volumes/*", "/Users/*", "/private/tmp/*", "/tmp/*")) and
  not (process.parent.code_signature.trusted == true and process.parent.code_signature.team_id in ("8CA6NAN723", "Y75Z7G683Y", "7JVNAY4725")) and
  not process.Ext.effective_parent.executable == "/Applications/Airtame.app/Contents/MacOS/Airtame"
'''

min_endpoint_version = "8.10.2"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[threat.technique.subtechnique]]
id = "T1562.006"
name = "Indicator Blocking"
reference = "https://attack.mitre.org/techniques/T1562/006/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.2"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.