MALW TinyShell backconnect OSX

Hunt Hypothesis

This hunt targets macOS systems exhibiting the specific network callback behavior of the TinyShell malware, which establishes persistent back-connect channels to command and control servers. Proactively hunting for this signature in Azure Sentinel is critical because early detection of these low-severity connections can prevent lateral movement and data exfiltration before the malware escalates its activities within the endpoint environment.

YARA Rule

rule MALW_TinyShell_backconnect_OSX {
 meta:
    date = "2018-02-10"
    author = "@unixfreaxjp"
 condition:
    is__osx
    and priv01
    and priv02
    and priv03
    and priv04
    and filesize < 100KB
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the MALW TinyShell backconnect OSX detection rule in an enterprise environment, along with suggested filters or exclusions:

• Scenario: Automated macOS Software Updates via MDM Push

  • Context: Managed Device Management (MDM) solutions like Jamf Pro, Microsoft Intune, or Endpoint Protector frequently utilize background shell scripts to check for and install OS updates. These processes often spawn tiny_shell or similar lightweight interpreters that initiate outbound HTTPS connections to Apple’s update servers (updates.apple.com) or the MDM cloud controller.
  • Suggested Filter: Exclude traffic where the source process is a known system binary (e.g., /System/Library/CoreServices/SoftwareUpdateAgent.app) OR the destination IP belongs to the verified Apple Update CIDR range, provided the connection occurs during standard maintenance windows (e.g., 02:00–06:00 local time).

• Scenario: Scheduled Log Rotation and Archiving Jobs

  • Context: Enterprise compliance requirements often mandate daily log rotation. Administrators frequently deploy cron jobs or LaunchAgents that execute a custom shell script to compress logs (using tar/gzip) and upload them to an internal SIEM collector, Azure Blob Storage, or AWS S3 bucket via curl or wget. These scripts often run as the _system user using a minimal shell environment.
  • Suggested Filter: Create an exclusion for connections originating from specific scheduled job paths (e.g., /Library/LaunchDaemons/com.company.logrotate.plist) targeting internal IP ranges associated with the organization’s SIEM or storage infrastructure, specifically filtering for HTTP/HTTPS protocols on ports 443 and 80.

• Scenario: Third-Party Endpoint Security Agent Communication

  • Context: Next-generation