LC_LOAD_DYLIB Addition

DeviceProcessEvents
| where Timestamp > ago(24h)
| where DeviceOSPlatform has_any ("macOS", "Mac", "Darwin")
| where FileName in~ ("install_name_tool", "otool", "codesign", "lipo", "jtool", "jtool2", "macho_tool")
| extend IsDylibOperation = ProcessCommandLine has_any (
    "-add_rpath", "-change", "-rpath", "LC_LOAD_DYLIB",
    "@rpath", "@loader_path", "@executable_path"
  )
| extend TargetBinary = extract(@"(?:install_name_tool|otool)\s+(?:-[\w]+\s+){0,5}([\S]+\.(dylib|app|bundle|bin|[a-z]+))", 1, ProcessCommandLine)
| where IsDylibOperation
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         TargetBinary, IsDylibOperation,
         InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc

index=syslog sourcetype=syslog host=*mac*
| eval IsMachoTool=if(match(_raw, "(install_name_tool|otool|codesign|lipo|jtool)"), 1, 0)
| eval IsDylibOp=if(match(_raw, "(-add_rpath|LC_LOAD_DYLIB|@rpath|@loader_path|@executable_path|-change|-rpath)"), 1, 0)
| eval IsFileWrite=if(match(_raw, "(\.dylib|/Library/|/usr/lib/|/System/Library/)"), 1, 0)
| where IsMachoTool=1 OR (IsDylibOp=1 AND IsFileWrite=1)
| table _time, host, user, _raw, IsMachoTool, IsDylibOp
| sort - _time

process where host.os.type == "macos" and event.type == "start" and process.name in ("install_name_tool", "otool", "codesign", "lipo", "jtool", "jtool2", "macho_tool") and process.args : ("-add_rpath", "-change", "-rpath", "LC_LOAD_DYLIB", "@rpath", "@loader_path", "@executable_path")

SELECT DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time, sourceip, username, hostname, "processname", "commandline", CATEGORYNAME(category) AS category_name FROM events WHERE LOGSOURCETYPENAME(devicetype) IN ('Apple Mac OS X', 'Linux') AND LOWER("processname") IN ('install_name_tool', 'otool', 'codesign', 'lipo', 'jtool', 'jtool2', 'macho_tool') AND ("commandline" ILIKE '%-add_rpath%' OR "commandline" ILIKE '%LC_LOAD_DYLIB%' OR "commandline" ILIKE '%@rpath%' OR "commandline" ILIKE '%@loader_path%' OR "commandline" ILIKE '%@executable_path%' OR "commandline" ILIKE '%-change%' OR "commandline" ILIKE '%-rpath%') AND starttime > NOW() - 86400000 ORDER BY starttime DESC

_sourceCategory=*macos* OR _sourceCategory=*endpoint* OR _sourceCategory=*syslog*
| where _raw matches /install_name_tool|otool|codesign|lipo|jtool|jtool2|macho_tool/
| parse regex "(?<process_name>install_name_tool|otool|codesign|lipo|jtool|jtool2|macho_tool)" nodrop
| parse regex "(?<dylib_arg>-add_rpath|-change\s|-rpath\s|LC_LOAD_DYLIB|@rpath|@loader_path|@executable_path)" nodrop
| where !isNull(dylib_arg)
| parse regex field=_raw "user[=:\s]+(?<username>[^\s]+)" nodrop
| parse regex field=_raw "host[=:\s]+(?<hostname>[^\s]+)" nodrop
| count by _time, hostname, username, process_name, dylib_arg
| sort by _time desc

rule macos_lc_load_dylib_addition {
  meta:
    author = "Detection Engineering"
    description = "Detects use of Mach-O binary manipulation tools with LC_LOAD_DYLIB-related arguments indicating potential dylib injection for persistence (T1546.006)"
    mitre_attack_tactic = "Persistence"
    mitre_attack_technique = "T1546.006"
    severity = "HIGH"
    priority = "HIGH"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.principal.platform = "MAC"
    $e.target.process.file.full_path = /install_name_tool|otool|codesign|lipo|jtool|jtool2|macho_tool/ nocase
    (
      $e.target.process.command_line = /-add_rpath/ nocase or
      $e.target.process.command_line = /-change / nocase or
      $e.target.process.command_line = /-rpath / nocase or
      $e.target.process.command_line = /LC_LOAD_DYLIB/ nocase or
      $e.target.process.command_line = /@rpath/ nocase or
      $e.target.process.command_line = /@loader_path/ nocase or
      $e.target.process.command_line = /@executable_path/ nocase
    )

  condition:
    $e
}

#event_simpleName=ProcessRollup2
| ImageFileName = /install_name_tool|otool|codesign|lipo|jtool|jtool2|macho_tool/i
| CommandLine = /-add_rpath|-change |-rpath |LC_LOAD_DYLIB|@rpath|@loader_path|@executable_path/i
| event_platform = "Mac"
| table([_time, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, ParentCommandLine, TargetProcessId])
| sort(field=_time, order=desc)