Suspicious Child Process Spawned by Browsers on macOS via Shell and Script Runtimes

title: Suspicious Child Process Spawned by Browsers on macOS via Shell and Script Runtimes
id: 3e2c6947-7d45-4bb9-9d23-378be46dda4a
status: test
description: This rule flags macOS process creations where the parent process appears to be a browser component (including WebKit WebContent and major browser executables) and the child executable is a shell or common script/network utility. Such activity can indicate browser exploitation or abuse to launch local code using interpreters and tools like bash, sh, python, perl, curl, wget, or osascript. It relies on process creation telemetry containing the parent image, child image path suffix, and command-line content, while excluding known benign browser installation, update, autoupdate, Edge utility behavior, and Chrome recovery paths.
references:
  - https://fr.slideshare.net/codeblue_jp/cb19-recent-apt-attack-on-crypto-exchange-employees-by-heungsoo-kang
  - https://github.com/elastic/detection-rules/blob/4312d8c9583be524578a14fe6295c3370b9a9307/rules/macos/execution_initial_access_suspicious_browser_childproc.toml
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_susp_browser_child_process.yml
author: Sohan G (D4rkCiph3r), Huntrule Team
date: 2023-04-05
tags:
  - attack.initial-access
  - attack.execution
  - attack.t1189
  - attack.t1203
  - attack.t1059
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    ParentImage|contains:
      - com.apple.WebKit.WebContent
      - firefox
      - Google Chrome Helper
      - Google Chrome
      - Microsoft Edge
      - Opera
      - Safari
      - Tor Browser
    Image|endswith:
      - /bash
      - /curl
      - /dash
      - /ksh
      - /osascript
      - /perl
      - /php
      - /pwsh
      - /python
      - /sh
      - /tcsh
      - /wget
      - /zsh
  filter_main_generic:
    CommandLine|contains: --defaults-torrc
  filter_main_ms_autoupdate:
    CommandLine|contains: /Library/Application Support/Microsoft/MAU*/Microsoft AutoUpdate.app/Contents/MacOS/msupdate
  filter_main_chrome:
    ParentImage|contains:
      - Google Chrome Helper
      - Google Chrome
    CommandLine|contains:
      - /Volumes/Google Chrome/Google Chrome.app/Contents/Frameworks/*/Resources/install.sh
      - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/*/Resources/keystone_promote_preflight.sh
      - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/*/Resources/keystone_promote_postflight.sh
  filter_main_ms_edge:
    ParentImage|contains: Microsoft Edge
    CommandLine|contains:
      - IOPlatformExpertDevice
      - hw.model
  filter_main_chromerecovery:
    ParentImage|contains:
      - Google Chrome Helper
      - Google Chrome
    CommandLine|contains|all:
      - /Users/
      - /Library/Application Support/Google/Chrome/recovery/
      - /ChromeRecovery
  filter_optional_null:
    CommandLine: null
  filter_optional_empty:
    CommandLine: ""
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Legitimate browser install, update and recovery scripts
level: medium
license: DRL-1.1
related:
  - id: 0250638a-2b28-4541-86fc-ea4c558fa0c6
    type: derived