[rule]
description = """
Detects the execution of curl via osascript with the "-o" argument indicating a file download. This activity should be
highly abnormal and considered suspicious at least. Threat actors have consistently been seen utilizing this technique
to establish C2 or download additional payloads / tools.
"""
id = "883cbfd8-278a-403c-907a-aefb02da0429"
license = "Elastic License v2"
name = "Curl Executable File Download via Osascript"
os_list = ["macos"]
version = "1.0.15"
query = '''
file where event.action == "modification" and file.Ext.header_bytes like~ ("cffaedfe*", "cafebabe*") and
process.name in ("curl", "nscurl") and Effective_process.name == "osascript"
'''
min_endpoint_version = "8.10.2"
optional_actions = []
[[actions]]
action = "kill_process"
field = "Effective_process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1105"
name = "Ingress Tool Transfer"
reference = "https://attack.mitre.org/techniques/T1105/"
[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"
[internal]
min_endpoint_version = "8.10.2"