{"id":"0250638a-2b28-4541-86fc-ea4c558fa0c6","title":"Suspicious Browser Child Process - MacOS","description":"Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.","author":"Sohan G (D4rkCiph3r)","status":"test","level":"medium","date":"2023-04-05","modified":"","tags":["attack.initial-access","attack.execution","attack.t1189","attack.t1203","attack.t1059"],"technique_ids":["T1059","T1189","T1203"],"logsource":{"category":"process_creation","product":"macos"},"falsepositives":["Legitimate browser install, update and recovery scripts"],"references":["https://fr.slideshare.net/codeblue_jp/cb19-recent-apt-attack-on-crypto-exchange-employees-by-heungsoo-kang","https://github.com/elastic/detection-rules/blob/4312d8c9583be524578a14fe6295c3370b9a9307/rules/macos/execution_initial_access_suspicious_browser_childproc.toml"],"source_path":"rules/macos/process_creation/proc_creation_macos_susp_browser_child_process.yml","source_sha256":"3aa8fef6ed00fe419cf2dc58e7f727fceac41dfa67b807fa02eddbcb39f9a2c1","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_susp_browser_child_process.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Browser Child Process - MacOS\nid: 0250638a-2b28-4541-86fc-ea4c558fa0c6\nstatus: test\ndescription: Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.\nreferences:\n    - https://fr.slideshare.net/codeblue_jp/cb19-recent-apt-attack-on-crypto-exchange-employees-by-heungsoo-kang\n    - https://github.com/elastic/detection-rules/blob/4312d8c9583be524578a14fe6295c3370b9a9307/rules/macos/execution_initial_access_suspicious_browser_childproc.toml\nauthor: Sohan G (D4rkCiph3r)\ndate: 2023-04-05\ntags:\n    - attack.initial-access\n    - attack.execution\n    - attack.t1189\n    - attack.t1203\n    - attack.t1059\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        ParentImage|contains:\n            - 'com.apple.WebKit.WebContent'\n            - 'firefox'\n            - 'Google Chrome Helper'\n            - 'Google Chrome'\n            - 'Microsoft Edge'\n            - 'Opera'\n            - 'Safari'\n            - 'Tor Browser'\n        Image|endswith:\n            - '/bash'\n            - '/curl'\n            - '/dash'\n            - '/ksh'\n            - '/osascript'\n            - '/perl'\n            - '/php'\n            - '/pwsh'\n            - '/python'\n            - '/sh'\n            - '/tcsh'\n            - '/wget'\n            - '/zsh'\n    filter_main_generic:\n        CommandLine|contains: '--defaults-torrc' # Informs tor to use default config file\n    filter_main_ms_autoupdate:\n        CommandLine|contains: '/Library/Application Support/Microsoft/MAU*/Microsoft AutoUpdate.app/Contents/MacOS/msupdate' # Microsoft AutoUpdate utility\n    filter_main_chrome:\n        ParentImage|contains:\n            - 'Google Chrome Helper'\n            - 'Google Chrome'\n        CommandLine|contains:\n            - '/Volumes/Google Chrome/Google Chrome.app/Contents/Frameworks/*/Resources/install.sh' # Install the Google Chrome browser\n            - '/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/*/Resources/keystone_promote_preflight.sh' # Updates the Google Chrome branding configuration files\n            - '/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/*/Resources/keystone_promote_postflight.sh' # Script that performs the post-installation tasks\n    filter_main_ms_edge:\n        ParentImage|contains: 'Microsoft Edge'\n        CommandLine|contains:\n            - 'IOPlatformExpertDevice' # Retrieves the IOPlatformUUID (parent process - Microsoft Edge)\n            - 'hw.model' # Retrieves model name of the computer's hardware (parent process - Microsoft Edge)\n    filter_main_chromerecovery:\n        ParentImage|contains:\n            - 'Google Chrome Helper'\n            - 'Google Chrome'\n        CommandLine|contains|all:\n            - '/Users/'\n            - '/Library/Application Support/Google/Chrome/recovery/'\n            - '/ChromeRecovery'\n    filter_optional_null:\n        # Aoids alerting for the events which do not have command-line arguments\n        CommandLine: null\n    filter_optional_empty:\n        # Aoids alerting for the events which do not have command-line arguments\n        CommandLine: ''\n    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfalsepositives:\n    - Legitimate browser install, update and recovery scripts\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059","id":"T1059","name":"Command and Scripting Interpreter","page":"techniques/enterprise/T1059/"},{"key":"enterprise/T1189","id":"T1189","name":"Drive-by Compromise","page":"techniques/enterprise/T1189/"},{"key":"enterprise/T1203","id":"T1203","name":"Exploitation for Client Execution","page":"techniques/enterprise/T1203/"}],"data_path":"data/detection-rules/0250638a-2b28-4541-86fc-ea4c558fa0c6.json","kind":"sigma"}