macOS Malware Detected with osquery

AnalysisType: rule
Filename: osquery_mac_osx_attacks.py
RuleID: "Osquery.Mac.OSXAttacks"
DisplayName: "macOS Malware Detected with osquery"
Enabled: true
LogTypes:
  - Osquery.Differential
Tags:
  - Osquery
  - MacOS
  - Malware
  - Resource Development:Develop Capabilities
Reports:
  MITRE ATT&CK:
    - TA0042:T1588
Severity: Medium
Description: Malware has potentially been detected on a macOS system
Runbook: Check the executable against VirusTotal
Reference: https://github.com/osquery/osquery/blob/master/packs/osx-attacks.conf
SummaryAttributes:
  - name
  - hostIdentifier
  - action
Tests:
  - Name: Valid malware discovered
    ExpectedResult: true
    Log:
      {
        "name": "pack_osx-attacks_Leverage-A_1",
        "action": "added",
        "hostIdentifier": "test-host",
        "columns":
          {
            "path": "/Users/johnny/Desktop/Siri.app/Contents/MacOS/Siri",
            "pid": 100,
            "name": "Siri",
          },
      }
  - Name: Keyboard event taps query is ignored
    ExpectedResult: false
    Log:
      {
        "name": "pack_osx-attacks_Keyboard_Event_Taps",
        "action": "added",
        "hostIdentifier": "test-host",
        "columns":
          {
            "path": "/System/Library/CoreServices/Siri.app/Contents/MacOS/Siri",
            "pid": 100,
            "name": "Siri",
          },
      }


# ------ paired body: osquery_mac_osx_attacks.py ------

def rule(event):
    if "osx-attacks" not in event.get("name", ""):
        return False

    # There is another rule specifically for this query
    if "Keyboard_Event_Taps" in event.get("name", ""):
        return False

    if event.get("action") != "added":
        return False

    return True


def title(event):
    return f"MacOS malware detected on [{event.get('hostIdentifier')}]"