{"id":"e0cfaecd-602d-41af-988d-f6ccebb2af26","title":"Suspicious Installer Package Child Process","description":"Detects the execution of suspicious child processes from macOS installer package parent process. This includes osascript, JXA, curl and wget amongst other interpreters","author":"Sohan G (D4rkCiph3r)","status":"test","level":"medium","date":"2023-02-18","modified":"","tags":["attack.t1059","attack.t1059.007","attack.t1071","attack.t1071.001","attack.execution","attack.command-and-control"],"technique_ids":["T1059","T1059.007","T1071","T1071.001"],"logsource":{"category":"process_creation","product":"macos"},"falsepositives":["Legitimate software uses the scripts (preinstall, postinstall)"],"references":["https://redcanary.com/blog/clipping-silver-sparrows-wings/","https://github.com/elastic/detection-rules/blob/4312d8c9583be524578a14fe6295c3370b9a9307/rules/macos/execution_installer_package_spawned_network_event.toml"],"source_path":"rules/macos/process_creation/proc_creation_macos_installer_susp_child_process.yml","source_sha256":"d47430a670c3cebd54fac8e28d7bec63ea2d7d38558054ce77687f58107d7eb7","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_installer_susp_child_process.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Installer Package Child Process\nid: e0cfaecd-602d-41af-988d-f6ccebb2af26\nstatus: test\ndescription: Detects the execution of suspicious child processes from macOS installer package parent process. This includes osascript, JXA, curl and wget amongst other interpreters\nreferences:\n    - https://redcanary.com/blog/clipping-silver-sparrows-wings/\n    - https://github.com/elastic/detection-rules/blob/4312d8c9583be524578a14fe6295c3370b9a9307/rules/macos/execution_installer_package_spawned_network_event.toml\nauthor: Sohan G (D4rkCiph3r)\ndate: 2023-02-18\ntags:\n    - attack.t1059\n    - attack.t1059.007\n    - attack.t1071\n    - attack.t1071.001\n    - attack.execution\n    - attack.command-and-control\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection_installer:\n        ParentImage|endswith:\n            - '/package_script_service'\n            - '/installer'\n        Image|endswith:\n            - '/sh'\n            - '/bash'\n            - '/dash'\n            - '/python'\n            - '/ruby'\n            - '/perl'\n            - '/php'\n            - '/javascript'\n            - '/osascript'\n            - '/tclsh'\n            - '/curl'\n            - '/wget'\n        CommandLine|contains:\n            - 'preinstall'\n            - 'postinstall'\n    condition: selection_installer\nfalsepositives:\n    - Legitimate software uses the scripts (preinstall, postinstall)\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059","id":"T1059","name":"Command and Scripting Interpreter","page":"techniques/enterprise/T1059/"},{"key":"enterprise/T1059.007","id":"T1059.007","name":"JavaScript","page":"techniques/enterprise/T1059.007/"},{"key":"enterprise/T1071","id":"T1071","name":"Application Layer Protocol","page":"techniques/enterprise/T1071/"},{"key":"enterprise/T1071.001","id":"T1071.001","name":"Web Protocols","page":"techniques/enterprise/T1071.001/"}],"data_path":"data/detection-rules/e0cfaecd-602d-41af-988d-f6ccebb2af26.json","kind":"sigma"}