Suspicious Terminal Child Process Execution

Description

Detects the execution of a process in a suspicious location by the Terminal application. Terminal will, often times, be granted full disk access by users and administrators who use it. Threat actors are aware of this and will abuse it in order to get their payloads to execute with the same context as Terminal, providing their payload full disk access. They do this by modifying shell profiles (e.g .zshrc, bashrc, etc.) that point to and execute their payload then when Terminal initiates those profiles the payload gets executed within the same context as Terminal.

Query · eql

process where event.type == "start" and event.action == "exec" and 
 user.name == "root" and 
 process.parent.name like~ "terminal" and
 process.name like~ ("terminal", "zsh", "bash", "sh", "tclsh*") and
 process.args == "-c" and
 process.args like~ 
               ("/private/tmp/*", 
                "/var/tmp/*", 
                "/tmp/*", 
                "/var/folders/*", 
                "/Users/Shared/*", 
                "/Library/Containers/*", 
                "/var/root/*", 
                "/Library/WebServer/*", 
                "/Library/Graphics/*",
                "/Library/Fonts/*", 
                "/usr/local/bin/*", 
                "/Users/*/Library/*", 
                "/Users/*/Applications/*")
Raw source Suspicious Terminal Child Process Execution · Elastic TOML
Esc
Published by elastic/protections-artifacts ↗, licensed under Elastic License 2.0 ↗. Reproduced here unmodified. 
[rule]
description = """
Detects the execution of a process in a suspicious location by the Terminal application. Terminal will, often times, be
granted full disk access by users and administrators who use it. Threat actors are aware of this and will abuse it in
order to get their payloads to execute with the same context as Terminal, providing their payload full disk access. They
do this by modifying shell profiles (e.g .zshrc, bashrc, etc.) that point to and execute their payload then when
Terminal initiates those profiles the payload gets executed within the same context as Terminal.
"""
id = "8e88d216-af7a-4f5c-8155-fa7d2be03987"
license = "Elastic License v2"
name = "Suspicious Terminal Child Process Execution"
os_list = ["macos"]
reference = ["https://cedowens.medium.com/give-me-some-macos-context-c13aecbd4c5b"]
version = "1.0.21"

query = '''
process where event.type == "start" and event.action == "exec" and 
 user.name == "root" and 
 process.parent.name like~ "terminal" and
 process.name like~ ("terminal", "zsh", "bash", "sh", "tclsh*") and
 process.args == "-c" and
 process.args like~ 
               ("/private/tmp/*", 
                "/var/tmp/*", 
                "/tmp/*", 
                "/var/folders/*", 
                "/Users/Shared/*", 
                "/Library/Containers/*", 
                "/var/root/*", 
                "/Library/WebServer/*", 
                "/Library/Graphics/*",
                "/Library/Fonts/*", 
                "/usr/local/bin/*", 
                "/Users/*/Library/*", 
                "/Users/*/Applications/*")
'''

min_endpoint_version = "8.10.2"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.10.2"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.