[rule]
description = """
Identifies the Osascript process accessing cloud credential and configuration files. Adversaries may attempt to access
these files in order to gain access to sensitive data, laterally move or gain initial access into a cloud environment.
"""
id = "a8b16aed-8ba0-45e7-8a73-088a3017de28"
license = "Elastic License v2"
name = "Cloud Credential Files Accessed by Osascript"
os_list = ["macos"]
version = "1.0.5"
query = '''
file where event.action == "open" and
file.path like~ ("/Users/*/.aws/*", "/Users/*/.config/gcloud/credentials.db", "/Users/*/.azure/*") and
process.name == "osascript"
'''
min_endpoint_version = "8.11.1"
optional_actions = []
[[actions]]
action = "kill_process"
field = "Effective_process.executable"
state = 0
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"
[[threat.technique.subtechnique]]
id = "T1552.001"
name = "Credentials In Files"
reference = "https://attack.mitre.org/techniques/T1552/001/"
[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[internal]
min_endpoint_version = "8.11.1"