Potential TerminalFix Attack via Remote Base64 Encoded Payload

[rule]
description = """
Detects a TerminalFix-style attack where a base64 encoded payload is decoded and piped to a shell interpreter for
execution, resulting in a curl download. This technique is commonly used in social engineering attacks where victims are
tricked into copying and pasting malicious commands from fake error dialogs or verification prompts into the Terminal
window.
"""
id = "8621ad76-076e-4ebb-a028-3055d4ee6e50"
license = "Elastic License v2"
name = "Potential TerminalFix Attack via Remote Base64 Encoded Payload"
os_list = ["macos"]
reference = ["https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/"]
version = "1.0.1"

query = '''
sequence by process.Ext.effective_parent.name, process.Ext.effective_parent.entity_id with maxspan=10s
[process where event.type == "start" and event.action == "exec" and process.name == "base64" and 
  process.args in ("-d", "-D", "--decode") and process.Ext.effective_parent.name == "Terminal" and process.args_count == 2  and 
  process.parent.command_line in ("-zsh", "bash", "sh", "zsh", "-bash", "-sh")]
[process where event.type == "start" and event.action == "exec" and process.name in ("curl", "nscurl") and 
 process.args like ("-s*", "-k*") and process.args like "http*" and process.parent.command_line in ("bash", "sh", "zsh") and process.args_count <= 5]
'''

min_endpoint_version = "8.16.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
[[threat.technique.subtechnique]]
id = "T1566.002"
name = "Spearphishing Link"
reference = "https://attack.mitre.org/techniques/T1566/002/"



[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"
[[threat.technique.subtechnique]]
id = "T1204.004"
name = "Malicious Copy and Paste"
reference = "https://attack.mitre.org/techniques/T1204/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.16.0"