5. Cleanup osascript deletes the temp AppleScript: rm -rf /var/folders/.../T/6202033 Approx. 618ms from setup.js execution to full cleanup. The dropper, the malicious package.json, and the temp AppleScript, all gone.

Great find and write-up from the team @Unit42_Intel. I wrote a small unsafe PyYAML loader script to remotely load and execute the YAML deserialization payload. I also built out a Python+Flask C2 Server on an "attacker" VM to handle all communication as specified in the loader and stealer payloads. I then modified the hardcoded values and executed in my lab to emulate the entire attack end-to-end against a MacOS Sequoia VM. More to come, soon, on all of this but with our @elastic #macOS Endpoint Behavior Rules we can detect and prevent these "stealthy" script based intrusions the #DPRK is so fond of. Below you can see our Alerts, AI Attack Discovery Summary and Process Tree Analyzer.

And finally our YARA rules detected the 'sea_update' payload as a Mythic payload the moment it hits disk.

Rule Name: Payload Delivery via Curl and Immediate Execution Detects when an executable file is created by Curl, immediately made executable by Chmod and executed all within a 30 second timespan by the same parent process.

Rule Name: Unsigned or Untrusted Process Execution via Installer Detects the unusual execution of an unsigned or untrusted process via the Installer binary. Here it detects the execution of the downloaded poseidon payload via the package install script.

Rule Name: Suspicious File Attribute Clearing Detects the unusual invocation of the Xattr binary to remove the file quarantine attributes of a file. In this case it caught the pre-install script removing this attribute for the downloaded poseidon payload.

Can't say enough good things about the team @moonlock_lab. If you aren't following them and haven't taken a look at their research then make sure you do. #macOS package here that uses its pre-install script as a dropper for a #MythicC2 #poseidon payload. Definitely nothing complex, not trying to hide and looks a bit Red Teamy but a good case study regardless. Below you can see the @elastic Process Analyzer view showing us the process tree for the pre-install script execution which matches the actions in the script Moonlock posted. Lets talk detection 🛡️ 🧵

Solid breakdown here detailing a new variant in this ongoing #DPRK campaign tracked by the STRIKE team @security_score. They track the campaign under several different names (Operation 99, Phantom Circuit, Operation Marstech) based on the variant, which targets developers, cross-platform, via malicious Nodejs applications which in turn drop and execute Python backdoors/modules. You will see this campaign also tracked by other security researchers as “#InvisibleFerret”, “#ContagiousInterview”, etc.. @elastic we have detected different variants of this campaign targeting our users on #macOS in the wild in the past few months. Regardless of the extensive evasion updates the developers have made to avoid static detection, successfully, we have been able to surface these attacks and protect users by focusing on the Behaviors these script based samples exhibit. securityscorecard.com/wp-con… Some Additional Write-ups for this Campaign: unit42.paloaltonetworks.com/… blog.phylum.io/smuggling-mal… github.com/0x50D4/0x50d4.git…

Very interesting find by the team @proofpoint detailing payload delivery and initial access techniques via web inject campaigns that masquerade as fake browser updates targeting #macOS systems with a #stealer Proofpoint has dubbed #FrigidStealer. @elastic ML Mach-O model detects the sample on disk and our Endpoint Behavior ruleset for macOS provides comprehensive coverage. Process Analyzer, Behavior Rule Breakdown and C2 details in screenshots below. proofpoint.com/us/blog/threa…

Nice find @bruce_k3tta. Definitely looks like this #macOS #stealer is in development. Uses common techniques we've seen other stealers utilize in the past and seems to only be concerned with the user keychain and web browsers files. Lets do a little #Elastic Endpoint Behavior breakdown. Upon execution it does the following: 1. Prompts for user password via an 'Osascript' prompt 2. Validates the user password using 'Dscl' 3. Executes 'System_Profiler' via shell command 4. Checks its external IP address via 'ip-api[.]com' 5. Accesses user Keychain DB and Web Browser files 6. Creates a file 'beacon_content.json' in /tmp 7. Exfiltrates data to '35.172.69[.]60 (upload.uploadcare[.]com)' 8. Deletes file 'beacon_content.json' in /tmp MacOS Production Endpoint Behavior Rules Triggered: - Potential Credentials Phishing via Osascript - Web Browser Credential Data Accessed by Unsigned or Untrusted Process - External IP address discovery via Curl

Nice find and write-up by @Tera0017. Interesting tactic attempting to use the #XProtect string encryption algo to try and evade static detection but like @patrickwardle states this story has been blown WAY way out of proportion. #Banshee is a very basic #macOS stealer not to mention its source code recently leaked. #Elastic can detect the entire execution chain using our Endpoint Behavior rules alone. Our YARA rules and ML model detect the samples as well.

New #Cuckoo campaign with only 4 (currently) static detections on VT (one of those 4 being @elastic). As always, #macOS Elastic Endpoint Behavior detections for the win 💪