Suspicious Archive Creation via Ditto

[rule]
description = """
Detects the use of the Ditto utility on macOS to create a compressed archive. The AMOS stealer has used this lesser
known method for creating an archive containing the collected data for exfiltration via C2.
"""
id = "9aec8065-72d1-4e34-bac9-22ae1213dd41"
license = "Elastic License v2"
name = "Suspicious Archive Creation via Ditto"
os_list = ["macos"]
reference = [
    "https://moonlock.com/atomic-macos-stealer",
    "https://medium.com/@dineshdevadoss04/breaking-down-atomic-macos-stealer-amos-8cd5eea56024",
]
version = "1.0.9"

query = '''
process where event.type == "start" and event.action == "exec" and process.name == "ditto" and
 process.args in~ ("-c", "-k", "--sequesterRsrc", "--keepParent") and
 process.args like ("/Users/*", "/private/tmp/*", "/tmp/*", "/var/folders/*") and
 process.args like~ "*.zip*" and
 (process.parent.code_signature.exists == false or process.parent.code_signature.trusted == false) and
 not process.parent.executable like ("/opt/homebrew/*", "/usr/local/Cellar/*", "/usr/local/Homebrew/*") and 
 not process.Ext.effective_parent.executable like ("/Library/Intune/Microsoft Intune Agent.app/Contents/MacOS/IntuneMdmDaemon",
                                                  "/opt/homebrew/*",
                                                  "/Applications/Ghostty.app/Contents/MacOS/ghostty")
'''

min_endpoint_version = "8.11.1"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1074"
name = "Data Staged"
reference = "https://attack.mitre.org/techniques/T1074/"
[[threat.technique.subtechnique]]
id = "T1074.001"
name = "Local Data Staging"
reference = "https://attack.mitre.org/techniques/T1074/001/"



[threat.tactic]
id = "TA0009"
name = "Collection"
reference = "https://attack.mitre.org/tactics/TA0009/"

[internal]
min_endpoint_version = "8.11.1"