Potential Masquerading as System Binary


Description

Detects the execution, by root, of a non-Apple binary passing the path to a System binary as command-line arguments. This activity has only been observed being used by malware in order to masquerade as the system process for the purpose of remaining hidden on the victim machine.

Query · eql

process where event.type == "start" and event.action == "exec" and 
  process.args like "/System/*" and 
  process.parent.name in ("bash", "sh", "zsh") and 
  process.args_count == 1 and not 
  process.executable like ("/System/*", "/usr/libexec/*", "/usr/bin/*", "/usr/sbin/*", "/bin/*", "/sbin/*")
Raw source Potential Masquerading as System Binary · Elastic TOML
Esc
Published by elastic/protections-artifacts ↗, licensed under Elastic License 2.0 ↗. Reproduced here unmodified.
[rule]
description = """
Detects the execution, by root, of a non-Apple binary passing the path to a System binary as command-line arguments.
This activity has only been observed being used by malware in order to masquerade as the system process for the purpose
of remaining hidden on the victim machine.
"""
id = "bb1de0c7-3504-4b31-8d3e-928aa3acf64f"
license = "Elastic License v2"
name = "Potential Masquerading as System Binary"
os_list = ["macos"]
reference = ["https://www.jamf.com/blog/cryptojacking-macos-malware-discovered-by-jamf-threat-labs"]
version = "1.0.19"

query = '''
process where event.type == "start" and event.action == "exec" and 
  process.args like "/System/*" and 
  process.parent.name in ("bash", "sh", "zsh") and 
  process.args_count == 1 and not 
  process.executable like ("/System/*", "/usr/libexec/*", "/usr/bin/*", "/usr/sbin/*", "/bin/*", "/sbin/*")
'''

min_endpoint_version = "8.10.2"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1036"
name = "Masquerading"
reference = "https://attack.mitre.org/techniques/T1036/"
[[threat.technique.subtechnique]]
id = "T1036.004"
name = "Masquerade Task or Service"
reference = "https://attack.mitre.org/techniques/T1036/004/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.2"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.