OFTW v3.0 参加記録 - Training & Talks

sudo eslogger exec create rename unlink tcc_modify open close write fork exit mount unmount signal kextload kextunload cs_invalidated proc_check > events.json

name: Fetch → Preprocess → Analyze

on: push
permissions:
  contents: write        # allow the bot to commit results.csv

jobs:
  build:
    runs-on: ubuntu-latest
    env:
      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}   # expose the secret to every step
    steps:
      # 1. Source code
      - uses: actions/checkout@v4                     # latest checkout action 

      # 2. Python runtime
      - uses: actions/setup-python@v4
        with:
          python-version: "3.11"                      # use one interpreter for every script

      # 3  Dependencies
      - name: Install Python packages
        run: |
          python -m pip install --upgrade pip
          pip install requests tqdm tiktoken openai   

      # 4. Download & truncate (writes data_preprocessed/short.json)
      - name: Preprocess data
        run: python preprocess_data.py

      # 5. LLM analysis (reads ./data_preprocessed/short.json)
      - name: Analyze with o4-mini
        run: python use_llm.py

      # 6. Commit the CSV (if it changed)
      - name: Commit results.csv
        run: |
          git config --global user.name  'github-actions[bot]'
          git config --global user.email 'github-actions[bot]@users.noreply.github.com'
          git add results.csv
          git commit -m "Update analysis results" || echo "Nothing to commit"
          git pull --rebase
          git push

def prune_fields(item: dict) -> dict:
    """Return only the fields that are valuable for malware analysis."""

    proc = item.get("process", {})
    pr = {
        "event_type": item.get("event_type"),
        "time":       item.get("time"),

        # ---------- process ----------
        "process": {
            "pid":                proc.get("pid"),
            "ppid":               proc.get("ppid"),
            "start_time":         proc.get("start_time"),
            "argv":               proc.get("arguments"),       # full command‑line
            "executable_path":    proc.get("executable", {}).get("path"),
            "uid":                proc.get("audit_token", {}).get("uid"),
            "euid":               proc.get("audit_token", {}).get("euid"),
            "gid":                proc.get("audit_token", {}).get("gid"),
            "signing_id":         proc.get("signing_id"),
            "cdhash":             proc.get("cdhash"),
            "team_id":            proc.get("team_id"),
            "is_platform_binary": proc.get("is_platform_binary"),
            "image_uuid":         proc.get("image_uuid"),
        },
    }

    # ---------- file / fs events ----------
    ev = item.get("event", {})
    if "create" in ev:
        dst = ev["create"].get("destination", {}).get("existing_file", {})
        pr["event"] = {
            "create": {
                "destination_path": dst.get("path"),
                "inode":            dst.get("inode"),
                "mode":             dst.get("mode"),
                "uid":              dst.get("uid"),
                "gid":              dst.get("gid"),
            }
        }
    elif "rename" in ev:
        src = ev["rename"].get("source", {})
        dst = ev["rename"].get("destination", {}).get("existing_file", {})
        pr["event"] = {
            "rename": {
                "source_path":      src.get("path"),
                "destination_path": dst.get("path"),
                "inode":            dst.get("inode"),
                "mode":             dst.get("mode"),
                "uid":              dst.get("uid"),
                "gid":              dst.get("gid"),
            }
        }
    elif "exec" in ev:          # keep exec details too
        ex = ev["exec"].get("process", {})
        pr["event"] = {
            "exec": {
                "target_path":      ex.get("executable", {}).get("path"),
                "argv":             ex.get("arguments"),
                "cs_flags":         ex.get("cs_flags"),
                "signer_type":      ex.get("signer_type"),
            }
        }

    return pr

def analyze_json(file_path: str, model: str = "o4-mini") -> str:
    with open(file_path, "r", encoding="utf-8") as f:
        data_str = f.read()

    prompt = (
        f"""YOUR PROMPT

        Tasks:  
        1. Parse the input JSON array of EndpointSecurity (ES) events.  
        2. Identify sequences or individual events that plausibly indicate malware or post-exploitation behaviour.
        3. Give recommendations, possible artefacts to check and retrieve and a check list for a deeper investigation by a dedicated team.

        Context  
        - Event types present: exec, create, rename, unlink, tcc_modify, open, close, write, fork, exit, mount, unmount, signal, kextload, kextunload, cs_invalidated, proc_check.  
        - Typical malicious clues include:  
            - Unsigned or ad-hoc-signed binaries executed or kext-loaded.  
            - Exec / write / rename in temporary, hidden, or user-library paths (`/tmp`, `/var/folders`, `~/Library/*/LaunchAgents`, etc.).  
            - Rapid fork chains (“fork bombs”), unexpected `signal` storms, or `proc_check` failures.  
            - `tcc_modify` denying transparency-consent or privacy prompts.  
            - `mount` or `unmount` of disk images followed by `exec`.  
            - `cs_invalidated` on running code or `kextunload` immediately after `kextload`.  
            - Creation or unlinking of persistence files (LaunchAgents/Daemons, login hooks, cron, rc.plist).  
        - Treat developer tools, Apple-signed code, and items in `/Applications` as low-risk unless combined with other red flags.
        - List of typical malware behaviour / IOC to rely on:
            - Silver Sparrow style: LaunchAgent under ~/Library/Application Support/ with “agent_updater”-like name; DMG mount → exec chain; binary self-deletes.  
            - Shlayer style: “Flash Player” installer writes shell script to /private/tmp then launches via open; cleans up with unlink.  
            - XLoader style: hidden java-child process in ~/Library/Containers/... ; key-logging and clipboard read; persistence via user LaunchAgent.  
            - Adload style: ≥1 LaunchAgent **and** two LaunchDaemons, plus cron job; payload hidden in ~/Library/Application Support/<UUID>/<UUID>.  
            - MacStealer style: exfil files staged in /var/folders/*/T/* then zipped and POSTed, directory removed afterwards.  
            - TCC-bypass/ColdRoot: direct edits to TCC.db (tcc_modify) or cs_invalidated events on unsigned binaries touching privacy-protected resources.  
            - 2024 backdoors: unsigned bundle in user Library with innocuous icon; spawns reverse-shell child after 30-120 s sleep.  
            - Turtle (ransomware) pattern: burst of fork + write events (>500 files/min) followed by extension rename.  
            - LaunchAgent/LaunchDaemon persistence (MITRE T1543.001/.004): new *.plist in /Library/LaunchDaemons or ~/Library/LaunchAgents with RunAtLoad=true.  
            - Plist modification (MITRE T1647): sudden changes to Info.plist or LSEnvironment keys enabling hidden execution or dylib hijack.
        {data_str}
        """
    )

    completion = client.chat.completions.create(
        model=model,
        messages=[
            {"role": "system", "content": "You are an expert macOS incident-response analyst."},
            {"role": "user", "content": prompt}
        ]
    )

    return completion.choices[0].message.content.strip()

Analysis Results:
1. Suspicious execution chain  
  – 19:40:08 “Trading View” launched from /Volumes/Trading View (adhoc-signed, external volume)  
  – Immediately creates folder “521272586” under the user’s home and subdirs “Chromium”, “Chrome”  
  – Copies sensitive browser artefacts: Autofill0, Password1, Cookies2  
  – Spawns dscl (reads directory services), osascript, system_profiler (gathers system inventory)  
  – Writes “password-entered” and “login-keychain” files  
  – Zips the entire folder (ditto → 521272586.zip)  
  => Classic “stealer” behavior: harvest browser credentials, system info, keychain hints, bundle and prepare for exfiltration.  
2. Key artefacts to collect now  
  • /Volumes/Trading View/Trading View.app & associated helpers – check code signature, inspect binary for strings, sandbox escapes  
  • ~/521272586/ and ~/521272586.zip – exfiltrated payload, browser profiles, keychain dumps  
  • Chrome ~/Library/Application Support/Google/Chrome/Default/Cookies, Login Data, Local State  
  • Firefox ~/Library/Application Support/Firefox/Profiles/*.default*/cookies.sqlite, logins.json  
  • ~/Library/Keychains/login-keychain & password-entered file  
  • Shell history (~/.zsh_history) around 19:40:08  
  • /var/folders/*/T/com.apple.mobileassetd for MADAnalytics files  
  • /System/Library/AssetsV2/persisted/AutoControlManager & AutoAssetScheduler states  
  • TCC database (/Library/Application Support/com.apple.TCC/TCC.db) for unauthorized entries  
3. Recommended triage steps  
  a. Isolate the host (block further network egress)  
  b. Acquire a full disk image and live memory  
  c. Extract and inspect the “Trading View” binary with strings, lldb, Hopper/IDA  
  d. Decompress 521272586.zip, examine stolen data, check for exfil scripts or hardcoded C2  
  e. Audit browser extensions, check for malicious injected code or stolen session tokens  
  f. Review launchd, cron, LaunchAgents/Daemons for persistence plist entries (~/Library/LaunchAgents, /Library/LaunchDaemons)  
  g. Check for unexpected network connections in /var/log/wifi.log, pf or firewall logs around 19:40  
  h. Search syslog and unified logs for any cs_invalidated, kextload, or tcc_modify events  
4. Investigation checklist  
  1. Collect disk image & memory  
  2. Extract and validate “Trading View” code signature; compute hash against known malware DBs  
  3. Parse shell history for subsequent exfil commands  
  4. Recover browser data stolen; identify what exactly was grabbed  
  5. Analyze mobileassetd & chronod writes (may reveal other asset downloads or tracking)  
  6. Dump TCC.db and check consent grants for osascript or system_profiler  
  7. Review network sessions (packet captures, proxy logs) for POST of 521272586.zip  
  8. Hunt for persistence: new plist in ~/Library/LaunchAgents, ~/Library/LaunchDaemons, /etc/cron*  
  9. Audit kext, kernel messages for cs_invalidated or kextload/unload around activity  
  10. Elevate case to IR team for full forensic and IOC rollout