Suspicious Microsoft Office Child Process - MacOS

Title: Suspicious Microsoft Office Child Process - MacOS
Status: test
Description:Detects suspicious child processes spawning from microsoft office suite applications such as word or excel. This could indicates malicious macro execution
References:
  -https://redcanary.com/blog/applescript/
  -https://objective-see.org/blog/blog_0x4B.html
Author: Sohan G (D4rkCiph3r)
Date: 2023-01-31
modified:2023-02-04
Tags:

• -'attack.execution'
• -'attack.persistence'
• -'attack.t1059.002'
• -'attack.t1137.002'
• -'attack.t1204.002'

Logsource:

• product: macos
• category: process_creation

Detection:
  selection:
    ParentImage|contains:
      -'Microsoft Word'
      -'Microsoft Excel'
      -'Microsoft PowerPoint'
      -'Microsoft OneNote'

    Image|endswith:
      -'/bash'
      -'/curl'
      -'/dash'
      -'/fish'
      -'/osacompile'
      -'/osascript'
      -'/sh'
      -'/zsh'
      -'/python'
      -'/python3'
      -'/wget'

  condition:selection
Falsepositives:
  -Unknown
Level: high