New

The executive guide to generative AI

Read more

Sublime Plugin or Application Script Modification

edit

Sublime Plugin or Application Script Modification

edit

Adversaries may create or modify the Sublime application plugins or scripts to execute a malicious payload each time the Sublime application is started.

Rule type: eql

Rule indices:

  • auditbeat-*
  • logs-endpoint.events.*

Severity: low

Risk score: 21

Runs every: 5 minutes

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Elastic
  • Host
  • macOS
  • Threat Detection
  • Persistence

Version: 4 (version history)

Added (Elastic Stack release): 7.12.0

Last modified (Elastic Stack release): 8.4.0

Rule authors: Elastic

Rule license: Elastic License v2

Investigation guide

edit

Rule query

edit
file where event.type in ("change", "creation") and file.extension :
"py" and file.path : ( "/Users/*/Library/Application
Support/Sublime Text*/Packages/*.py", "/Applications/Sublime
Text.app/Contents/MacOS/sublime.py" ) and not process.executable
: ( "/Applications/Sublime Text*.app/Contents/*",
"/usr/local/Cellar/git/*/bin/git",
"/Library/Developer/CommandLineTools/usr/bin/git",
"/usr/libexec/xpcproxy", "/System/Library/PrivateFrameworks/Desk
topServicesPriv.framework/Versions/A/Resources/DesktopServicesHelper"
)

Threat mapping

edit

Framework: MITRE ATT&CKTM

Rule version history

edit
Version 4 (8.4.0 release)
  • Updated query, changed from:

    file where event.type in ("change", "creation") and file.extension :
    "py" and file.path : ( "/Users/*/Library/Application
    Support/Sublime Text*/Packages/*.py", "/Applications/Sublime
    Text.app/Contents/MacOS/sublime.py" ) and not process.executable
    : ( "/Applications/Sublime Text*.app/Contents/MacOS/Sublime
    Text*", "/usr/local/Cellar/git/*/bin/git",
    "/usr/libexec/xpcproxy", "/System/Library/PrivateFrameworks/Des
    ktopServicesPriv.framework/Versions/A/Resources/DesktopServicesHelper"
    , "/Applications/Sublime Text.app/Contents/MacOS/plugin_host"
    )
Version 2 (8.2.0 release)
  • Formatting only
Was this helpful?
Feedback