Self-Deleting Python Script

[rule]
description = """
Detects Python scripts that delete themselves after execution to evade detection. This technique removes evidence of
malicious activity by eliminating the script file from disk. Commonly observed in APT campaigns including those
attributed to DPRK-linked threat actors like Lazarus Group.
"""
id = "6461f45e-b03f-4756-94d2-34a210caeb78"
license = "Elastic License v2"
name = "Self-Deleting Python Script"
os_list = ["macos"]
reference = [
    "https://unit42.paloaltonetworks.com/slow-pisces-new-custom-malware/",
    "https://slowmist.medium.com/cryptocurrency-apt-intelligence-unveiling-lazarus-groups-intrusion-techniques-a1a6efda7d34",
]
version = "1.0.5"

query = '''
sequence by process.entity_id with maxspan=10s
[process where event.type == "start" and event.action == "exec" and process.name like~ "python*" and 
  process.args_count == 2] as event0
[file where event.action == "deletion" and file.extension == "py" and 
  stringcontains~(event0.process.command_line, file.path)]
'''

min_endpoint_version = "8.16.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.006"
name = "Python"
reference = "https://attack.mitre.org/techniques/T1059/006/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1070"
name = "Indicator Removal"
reference = "https://attack.mitre.org/techniques/T1070/"
[[threat.technique.subtechnique]]
id = "T1070.004"
name = "File Deletion"
reference = "https://attack.mitre.org/techniques/T1070/004/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.16.0"