[rule]
description = """
Detects the execution, by root, of a non-Apple binary passing the path to a System binary as command-line arguments.
This activity has only been observed being used by malware in order to masquerade as the system process for the purpose
of remaining hidden on the victim machine.
"""
id = "bb1de0c7-3504-4b31-8d3e-928aa3acf64f"
license = "Elastic License v2"
name = "Potential Masquerading as System Binary"
os_list = ["macos"]
reference = ["https://www.jamf.com/blog/cryptojacking-macos-malware-discovered-by-jamf-threat-labs"]
version = "1.0.19"
query = '''
process where event.type == "start" and event.action == "exec" and
process.args like "/System/*" and
process.parent.name in ("bash", "sh", "zsh") and
process.args_count == 1 and not
process.executable like ("/System/*", "/usr/libexec/*", "/usr/bin/*", "/usr/sbin/*", "/bin/*", "/sbin/*")
'''
min_endpoint_version = "8.10.2"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"
[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1036"
name = "Masquerading"
reference = "https://attack.mitre.org/techniques/T1036/"
[[threat.technique.subtechnique]]
id = "T1036.004"
name = "Masquerade Task or Service"
reference = "https://attack.mitre.org/techniques/T1036/004/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "8.10.2"