[rule]
description = """
Detects the execution of a Cocoa framework Applet binary. MacOS applications can be developed using Cocoa, which is a
set of frameworks providing a foundation for building graphical, event-driven applications on macOS. The use of this
type of Mach-O is extremely rare to see, especially within an application and should be considered suspicious. Threat
actors have utilized this method of binary creation due to being able to locally build and sign their payloads.
"""
id = "7f1ac069-ff3b-498e-8e2e-535cc89ba583"
license = "Elastic License v2"
name = "Cocoa Applet Binary Execution"
os_list = ["macos"]
reference = [
"https://www.bitdefender.com/blog/labs/new-macos-backdoor-written-in-rust-shows-possible-link-with-windows-ransomware-group/",
]
version = "1.0.4"
query = '''
process where event.type == "start" and event.action == "exec" and
(process.name == "cocoaapplet" or process.parent.name == "cocoaapplet")
'''
min_endpoint_version = "8.11.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.002"
name = "AppleScript"
reference = "https://attack.mitre.org/techniques/T1059/002/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[internal]
min_endpoint_version = "8.11.0"