Untrusted Process Execution with Invalid Plist or Code Signature

[rule]
description = """
Detects when an untrusted process is executed and the code signature status indicates an invalid info.plist file and the
code signature team id is empty. This is a unique pattern that has matched on a large number of different malware
samples and has not been seen to match on anything other than malicious samples.
"""
id = "b7516495-66f9-4cb9-abb9-3cede7a0aed7"
license = "Elastic License v2"
name = "Untrusted Process Execution with Invalid Plist or Code Signature"
os_list = ["macos"]
version = "1.0.12"

query = '''
process where event.type == "start" and process.code_signature.status == "invalid Info.plist (plist or signature have been modified)" and
 process.code_signature.exists == true and 
 length(process.code_signature.team_id) == 0 and 
 not process.executable like ("/opt/homebrew/*", "/usr/local/Cellar/*", "/Applications/AutoFirma.app/Contents/MacOS/AutoFirma") and
 not (process.code_signature.subject_name == "Developer ID Application: salesforce.com (62J96EUJ9N)" and process.code_signature.trusted == true) and
 not (process.parent.code_signature.team_id in ("2ZEFAR8TH3", "922YNK5MTB", "62J96EUJ9N") and
      process.parent.code_signature.trusted == true) and
 not process.parent.executable like ("/Library/Developer/CoreSimulator/*", "/Applications/AutoFirma.app/Contents/MacOS/AutoFirma", "/Applications/PCClient.app/Contents/MacOS/PCClient") and
 not process.Ext.effective_parent.executable in ("/Library/Developer/PrivateFrameworks/CoreSimulator.framework/Versions/A/XPCServices/SimulatorTrampoline.xpc/Contents/MacOS/SimulatorTrampoline",
                                                 "/Applications/AutoFirma.app/Contents/MacOS/AutoFirma", "/Applications/PCClient.app/Contents/MacOS/PCClient")
'''

min_endpoint_version = "8.11.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"
[[threat.technique.subtechnique]]
id = "T1204.002"
name = "Malicious File"
reference = "https://attack.mitre.org/techniques/T1204/002/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.11.0"