Suspicious Child Process of Expect

[rule]
description = """
Detects when commonly abused tools on macOS are executed via the Expect binary. The Expect binary on macOS (by default
and other Unix-like systems) is a powerful scripting tool designed to automate interactive applications. It utilizes the
TCL (Tool Command Language) for its syntax. An Expect script can be created using the .exp file extension. It can then
be executed as either a normal binary or via the Expect binary itself. Expect is ripe for abuse by threat actors that
can use it to avoid security controls and traditional defense detections.
"""
id = "e1b837f1-625b-4494-a489-20356b6dedc0"
license = "Elastic License v2"
name = "Suspicious Child Process of Expect"
os_list = ["macos"]
version = "1.0.6"

query = '''
process where event.type == "start" and event.action == "exec" and process.parent.name == "expect" and 
 ((process.name in ("curl", "nscurl", "osascript", "security", "node", "ruby")) or 
  (process.code_signature.trusted == false or process.code_signature.exists == false)) and
 process.Ext.effective_parent.executable != "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon"
'''

min_endpoint_version = "8.11.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.11.0"