LC_MAIN Hijacking

// Part 1: Detect use of Mach-O binary inspection and manipulation tools with suspicious flags
let MachOInspectionTools = dynamic(["otool", "jtool", "jtool2", "vtool", "MachOView", "install_name_tool", "lipo"]);
let SuspiciousLoadCmdFlags = dynamic(["-l", "--load-commands", "LC_MAIN", "LC_THREAD", "LC_UNIXTHREAD", "entryoff", "stacksize"]);
let SensitivePaths = dynamic(["/Applications/", "/usr/bin/", "/usr/local/bin/", "/usr/sbin/", "/bin/", "/sbin/", "/opt/"]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ (MachOInspectionTools)
| where ProcessCommandLine has_any (SuspiciousLoadCmdFlags)
| where ProcessCommandLine has_any (SensitivePaths)
| extend TargetBinary = extract(@"(?:/Applications/[^\s]+\.app/Contents/MacOS/[^\s]+|/usr/(?:bin|local/bin|sbin)/[^\s]+|/bin/[^\s]+|/opt/[^\s]+)", 0, ProcessCommandLine)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, TargetBinary,
         InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc
// Part 2: Detect writes to Mach-O executable locations by non-system processes
// Run separately or union with above
// DeviceFileEvents
// | where Timestamp > ago(24h)
// | where ActionType in ("FileModified", "FileCreated", "FileRenamed")
// | where FolderPath matches regex @"/Applications/[^/]+\.app/Contents/MacOS"
//    or FolderPath startswith "/usr/bin/"
//    or FolderPath startswith "/usr/local/bin/"
//    or FolderPath startswith "/usr/sbin/"
// | where not(InitiatingProcessFileName in~ ("Installer", "softwareupdate", "pkgutil", "MRT", "XProtect", "trustd"))
// | project Timestamp, DeviceName, AccountName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine

| union
  [search index=osquery sourcetype="osquery:results" name="pack_*_mach_o_info" OR name="pack_*_process_open_files"
  | eval FilePath=coalesce('columns.path', 'columns.filename')
  | where match(FilePath, "(?i)(/Applications/[^/]+\.app/Contents/MacOS/|/usr/(local/)?bin/|/usr/sbin/|/bin/|/opt/)")
  | eval QueryType="osquery_macho_file_access"
  | table _time, host, name, FilePath, QueryType]
  [search index=endpoint sourcetype="stream:process" OR sourcetype="macos:endpointsecurity"
  (process_name="otool" OR process_name="jtool" OR process_name="jtool2" OR process_name="vtool" OR process_name="install_name_tool" OR process_name="lipo")
  | eval CmdLine=coalesce(process_cmdline, cmd_line, cmdline)
  | eval CmdLineLower=lower(CmdLine)
  | eval HasLoadCmdFlag=if(match(CmdLineLower, "(-l|--load-commands|lc_main|lc_thread|lc_unixthread|entryoff|stacksize)"), 1, 0)
  | eval TargetsSensitivePath=if(match(CmdLine, "(/Applications/|/usr/bin/|/usr/local/bin/|/usr/sbin/|/bin/|/sbin/|/opt/)"), 1, 0)
  | where HasLoadCmdFlag=1 AND TargetsSensitivePath=1
  | eval QueryType="macho_tool_with_load_cmd_flag"
  | table _time, host, user, process_name, CmdLine, parent_process_name, HasLoadCmdFlag, TargetsSensitivePath, QueryType]
| sort - _time
| table _time, host, user, process_name, CmdLine, parent_process_name, QueryType

process where event.type == "start" and
  host.os.type == "macos" and
  process.name in ("otool", "jtool", "jtool2", "vtool", "install_name_tool", "lipo") and
  (
    process.args : "-l" or
    process.args : "--load-commands" or
    process.args : "LC_MAIN" or
    process.args : "LC_THREAD" or
    process.args : "LC_UNIXTHREAD" or
    process.args : "entryoff" or
    process.args : "stacksize"
  ) and
  (
    process.command_line : "/Applications/*" or
    process.command_line : "/usr/bin/*" or
    process.command_line : "/usr/local/bin/*" or
    process.command_line : "/usr/sbin/*" or
    process.command_line : "/bin/*" or
    process.command_line : "/sbin/*" or
    process.command_line : "/opt/*"
  )

SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  LOGSOURCENAME(logsourceid) AS log_source,
  sourceip AS host_ip,
  username,
  "Process Name" AS process_name,
  "Command" AS command_line,
  "Parent Process Name" AS parent_process
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Apple macOS Security', 'Syslog', 'Linux OS')
  AND (
    "Process Name" IN ('otool', 'jtool', 'jtool2', 'vtool', 'install_name_tool', 'lipo')
    OR "Process Name" ILIKE '%jtool%'
  )
  AND (
    "Command" ILIKE '% -l %'
    OR "Command" ILIKE '%--load-commands%'
    OR "Command" ILIKE '%LC_MAIN%'
    OR "Command" ILIKE '%LC_THREAD%'
    OR "Command" ILIKE '%LC_UNIXTHREAD%'
    OR "Command" ILIKE '%entryoff%'
    OR "Command" ILIKE '%stacksize%'
  )
  AND (
    "Command" ILIKE '%/Applications/%'
    OR "Command" ILIKE '%/usr/bin/%'
    OR "Command" ILIKE '%/usr/local/bin/%'
    OR "Command" ILIKE '%/usr/sbin/%'
    OR "Command" ILIKE '%/bin/%'
    OR "Command" ILIKE '%/sbin/%'
    OR "Command" ILIKE '%/opt/%'
  )
  AND devicetime > NOW() - 24 HOURS
ORDER BY devicetime DESC
LIMIT 500

_sourceCategory=endpoint/macos OR _sourceCategory=osquery/macos OR _sourceCategory=stream/process
| where !
  isEmpty(process_name)
| where process_name in ("otool", "jtool", "jtool2", "vtool", "install_name_tool", "lipo")
| where (
    cmdline matches "-l " or
    cmdline matches "--load-commands" or
    cmdline matches "LC_MAIN" or
    cmdline matches "LC_THREAD" or
    cmdline matches "LC_UNIXTHREAD" or
    cmdline matches "entryoff" or
    cmdline matches "stacksize"
  )
| where (
    cmdline matches "/Applications/" or
    cmdline matches "/usr/bin/" or
    cmdline matches "/usr/local/bin/" or
    cmdline matches "/usr/sbin/" or
    cmdline matches "/bin/" or
    cmdline matches "/sbin/" or
    cmdline matches "/opt/"
  )
| parse field=cmdline "* *" as tool_name, tool_args nodrop
| count by _time, host, user, process_name, cmdline, parent_process_name
| fields -_count
| sort by _time desc

rule lc_main_hijacking_macho_inspection {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects Mach-O inspection tools invoked with LC_MAIN or load command flags against sensitive macOS system binary paths, indicating potential entry-point offset reconnaissance for T1149."
    severity = "HIGH"
    priority = "HIGH"
    mitre_attack_tactic = "Defense Evasion"
    mitre_attack_technique = "T1149"
    platform = "macOS"
    false_positives = "Developer toolchains, Homebrew, security research"
    version = "1.0"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.metadata.vendor_name = "Apple"
    (
      $e.principal.process.file.full_path = /\/(otool|jtool2?|vtool|install_name_tool|lipo)$/ or
      $e.target.process.file.full_path = /\/(otool|jtool2?|vtool|install_name_tool|lipo)$/
    )
    (
      $e.target.process.command_line = /(\s-l\s|--load-commands|LC_MAIN|LC_THREAD|LC_UNIXTHREAD|entryoff|stacksize)/i
    )
    (
      $e.target.process.command_line = /(\/Applications\/|\/usr\/(local\/)?bin\/|\/usr\/sbin\/|\/bin\/|\/sbin\/|\/opt\/)/
    )

  condition:
    $e
}

#event_simpleName=ProcessRollup2
| FileName in ("otool", "jtool", "jtool2", "vtool", "install_name_tool", "lipo")
| regex(field=CommandLine, regex="(-l\\b|--load-commands|LC_MAIN|LC_THREAD|LC_UNIXTHREAD|entryoff|stacksize)", flags="i")
| regex(field=CommandLine, regex="(/Applications/|/usr/bin/|/usr/local/bin/|/usr/sbin/|/bin/|/sbin/|/opt/)", flags="i")
| OperatingSystemVersion = /macOS|Mac OS X/i OR PlatformName = /Mac/i
| groupBy(
    [ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, TargetProcessId, ContextProcessId],
    function=[
      count(aid, as=event_count),
      min(@timestamp, as=first_seen),
      max(@timestamp, as=last_seen)
    ]
  )
| sort(last_seen, order=desc)
| table(
    [last_seen, first_seen, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, TargetProcessId, event_count]
  )