Suspicious Browser Child Process - MacOS

Title: Suspicious Browser Child Process - MacOS
Status: test
Description:Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.
References:
  -https://fr.slideshare.net/codeblue_jp/cb19-recent-apt-attack-on-crypto-exchange-employees-by-heungsoo-kang
  -https://github.com/elastic/detection-rules/blob/4312d8c9583be524578a14fe6295c3370b9a9307/rules/macos/execution_initial_access_suspicious_browser_childproc.toml
Author: Sohan G (D4rkCiph3r)
Date: 2023-04-05
modified:None
Tags:

• -'attack.initial-access'
• -'attack.execution'
• -'attack.t1189'
• -'attack.t1203'
• -'attack.t1059'

Logsource:

• category: process_creation
• product: macos

Detection:
  selection:
    ParentImage|contains:
      -'com.apple.WebKit.WebContent'
      -'firefox'
      -'Google Chrome Helper'
      -'Google Chrome'
      -'Microsoft Edge'
      -'Opera'
      -'Safari'
      -'Tor Browser'

    Image|endswith:
      -'/bash'
      -'/curl'
      -'/dash'
      -'/ksh'
      -'/osascript'
      -'/perl'
      -'/php'
      -'/pwsh'
      -'/python'
      -'/sh'
      -'/tcsh'
      -'/wget'
      -'/zsh'

  filter_main_generic:
    CommandLine|contains: '--defaults-torrc'
  filter_main_ms_autoupdate:
    CommandLine|contains: '/Library/Application Support/Microsoft/MAU*/Microsoft AutoUpdate.app/Contents/MacOS/msupdate'
  filter_main_chrome:
    ParentImage|contains:
      -'Google Chrome Helper'
      -'Google Chrome'

    CommandLine|contains:
      -'/Volumes/Google Chrome/Google Chrome.app/Contents/Frameworks/*/Resources/install.sh'
      -'/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/*/Resources/keystone_promote_preflight.sh'
      -'/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/*/Resources/keystone_promote_postflight.sh'

  filter_main_ms_edge:
    ParentImage|contains: 'Microsoft Edge'
    CommandLine|contains:
      -'IOPlatformExpertDevice'
      -'hw.model'

  filter_main_chromerecovery:
    ParentImage|contains:
      -'Google Chrome Helper'
      -'Google Chrome'

    CommandLine|contains|all:
      -'/Users/'
      -'/Library/Application Support/Google/Chrome/recovery/'
      -'/ChromeRecovery'

  filter_optional_null:
    CommandLine: 'None'
  filter_optional_empty:
    CommandLine: ''
  condition:selection and not 1 of filter_main_* and not 1 of filter_optional_*
Falsepositives:
  -Legitimate browser install, update and recovery scripts
Level: medium