Detect Mach-O file produced by pyinstaller

Hunt Hypothesis

This hypothesis posits that adversaries are utilizing PyInstaller to package malicious Python scripts into executable Mach-O binaries, thereby evading traditional script-based detection mechanisms. Proactive hunting for these artifacts in Azure Sentinel is critical because legitimate use of this tooling can mask the initial execution phase of fileless or obfuscated attacks within macOS environments.

YARA Rule

rule MachO_File_pyinstaller
{
    meta:
        author = "KatsuragiCSL (https://katsuragicsl.github.io)"
        description = "Detect Mach-O file produced by pyinstaller"
    strings:
        $a = "pyi-runtime-tmpdir"
        $b = "pyi-bootloader-ignore-signals"
    condition:
        any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Detect Mach-O file produced by pyinstaller rule in an enterprise macOS environment:

• CI/CD Pipeline Artifact Deployment: Automated build agents (e.g., Jenkins or GitHub Actions running on macOS runners) compile internal Python utilities into standalone executables using PyInstaller as part of a nightly release cycle. These agents frequently generate Mach-O binaries within the /tmp or /builds directories before pushing them to artifact repositories.

  • Suggested Filter: Exclude file creation events where the parent process is jenkins, github-runner, or gitlab-ci-multi-runner and the file path contains standard build directory markers (e.g., /var/lib/jenkins/workspace/, /Users/github-runner/builds/).

• IT Service Desk Ticketing Tools: The enterprise utilizes a custom Python-based ticketing assistant installed on all helpdesk analyst workstations. This tool, wrapped via PyInstaller to ensure dependency portability across different OS versions, launches automatically at user login and generates temporary Mach-O cache files in the user’s local application support folder.

  • Suggested Filter: Create an exclusion for file paths under /Applications/HelpDesk-Tool.app/Contents/Resources/ or specific known hashes of the HelpDesk-Assistant executable generated by the IT deployment team (e.g., SCCM or Jamf).

• Scheduled Data Backup Scripts: A scheduled cron job runs a Python script wrapped in PyInstaller to perform local database integrity checks before initiating backups. This task executes every morning at 06:00 AM, creating temporary Mach-O binaries in the /var/log/backup-scripts directory to validate data consistency before the main backup agent starts.

  • Suggested Filter: Exclude events triggered by the launchd or cron parent processes where the file creation time falls within a defined maintenance window (e.g., 05