Detect Dylib Hijacking in Google Chronicle

rule macos_dylib_hijacking_suspicious_path {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects creation or modification of .dylib files in macOS paths commonly abused for dylib hijacking (T1574.004). Covers @rpath-adjacent directories including /tmp, /var/folders, and user Library paths where adversaries plant malicious dynamic libraries."
    mitre_attack_tactic = "Privilege Escalation, Persistence, Defense Evasion"
    mitre_attack_technique = "T1574.004"
    severity = "HIGH"
    priority = "HIGH"

  events:
    $e.metadata.event_type = "FILE_CREATION" or $e.metadata.event_type = "FILE_MODIFICATION"
    $e.principal.asset.platform_software.platform = "LINUX"
    re.regex($e.target.file.full_path, `\.dylib$`)
    (
      re.regex($e.target.file.full_path, `^/tmp/`) or
      re.regex($e.target.file.full_path, `^/private/tmp/`) or
      re.regex($e.target.file.full_path, `^/var/folders/`) or
      re.regex($e.target.file.full_path, `^/Users/[^/]+/Library/`) or
      re.regex($e.target.file.full_path, `^/Users/[^/]+/Library/Application Support/`)
    )

  condition:
    $e
}