[rule]
description = """
Detects the execution of a binary, from a volume mount, that has been self-signed using the native Codesign tool. The
specific code sign identifier scheme generated by this process matches on almost all North Korean payloads as they have
used this method to sign their malware like AppleJeus, for example, and most recently the 3CX supply chain 2nd stage
malware payload.
"""
id = "ac494288-08e1-4597-9a04-3526144de479"
license = "Elastic License v2"
name = "Execution of Self-Signed Binary from Volume Mount"
os_list = ["macos"]
version = "1.0.4"
query = '''
process where event.type == "start" and event.action == "exec" and
process.code_signature.signing_id regex~ """[A-Za-z0-9\_\s]{2,}\-[a-z0-9]{40}""" and
process.code_signature.trusted == false and
process.args_count <= 2 and
process.executable like "/Volumes/*"
'''
min_endpoint_version = "8.5.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[internal]
min_endpoint_version = "8.5.0"