MacOS Keyboard Events

AnalysisType: rule
Filename: osquery_mac_osx_attacks_keyboard_events.py
RuleID: "Osquery.Mac.OSXAttacksKeyboardEvents"
DisplayName: "MacOS Keyboard Events"
Enabled: true
LogTypes:
  - Osquery.Differential
Tags:
  - Osquery
  - MacOS
  - Malware
  - Collection:Input Capture
Reports:
  MITRE ATT&CK:
    - TA0009:T1056
Severity: Medium
Description: A Key Logger has potentially been detected on a macOS system
Runbook: Verify the Application monitoring the keyboard taps
Reference: https://support.apple.com/en-us/HT204899
SummaryAttributes:
  - name
  - hostIdentifier
  - action
Tests:
  - Name: App running on Desktop that is watching keyboard events
    ExpectedResult: true
    Log:
      {
        "name": "pack_osx-attacks_Keyboard_Event_Taps",
        "action": "added",
        "hostIdentifier": "test-host",
        "columns":
          {
            "path": "/Users/johnny/Desktop/Siri.app/Contents/MacOS/Siri",
            "pid": 100,
            "name": "Siri",
          },
      }
  - Name: App is running from approved path
    ExpectedResult: false
    Log:
      {
        "name": "pack_osx-attacks_Keyboard_Event_Taps",
        "action": "added",
        "hostIdentifier": "test-host",
        "columns":
          {
            "path": "/System/Library/CoreServices/Siri.app/Contents/MacOS/Siri",
            "pid": 100,
            "name": "Siri",
          },
      }
  - Name: Unrelated query does not alert
    ExpectedResult: false
    Log:
      {
        "action": "added",
        "calendarTime": "2020-04-10 23:26:11.000000000",
        "columns":
          {
            "blocks_size": "4096",
            "inodes": "2448101320",
            "path": "/",
            "blocks": "61202533",
            "blocks_available": "22755926",
            "blocks_free": "58479522",
            "device": "/dev/disk1s5",
            "device_alias": "/dev/disk1s5",
            "flags": "75550721",
            "inodes_free": "2447613763",
            "type": "apfs",
          },
        "counter": 28,
        "decorations":
          {
            "host_uuid": "0ec3540f-1dd9-4462-bd28-0f63b2611621",
            "hostname": "MacBook-Pro.local",
          },
        "epoch": 0,
        "hostIdentifier": "MacBook-Pro.local",
        "name": "pack/incident-response/mounts",
        "unixTime": 1586561171,
      }


# ------ paired body: osquery_mac_osx_attacks_keyboard_events.py ------

from fnmatch import fnmatch

# sip protects against writing malware into the paths below.
# additional apps can be added to this list based on your environments.
#
# more info: https://support.apple.com/en-us/HT204899
APPROVED_PROCESS_PATHS = {
    "/System/*",
    "/usr/*",
    "/bin/*",
    "/sbin/*",
    "/var/*",
}

APPROVED_APPLICATION_NAMES = {"Adobe Photoshop CC 2019"}


def rule(event):
    if "Keyboard_Event_Taps" not in event.get("name", ""):
        return False

    if event.get("action") != "added":
        return False

    process_path = event.deep_get("columns", "path", default="")
    if process_path == "":
        return False

    if event.deep_get("columns", "name") in APPROVED_APPLICATION_NAMES:
        return False

    # Alert if the process is running outside any of the approved paths
    # TODO: Convert this fnmatch pattern below to a helper
    return not any((fnmatch(process_path, p) for p in APPROVED_PROCESS_PATHS))


def title(event):
    return f"Keylogger malware detected on [{event.get('hostIdentifier')}]"