Curl Output Piped to Osascript


Description

Detects when curl or nscurl is executed followed by osascript execution within 15 seconds from the same parent process. This pattern indicates potential malicious workflows where curl output is being piped to osascript for AppleScript execution, commonly used for payload downloads and immediate execution or C2 communication.

Query · eql

sequence by process.parent.entity_id with maxspan=20s
[process where event.type == "start" and event.action == "exec" and
  process.name in ("curl", "nscurl") and process.parent.name in ("bash", "sh", "zsh")]
[process where event.type == "start" and event.action == "exec" and 
  ((process.args == "osascript" and process.args == "-l" and process.args == "JavaScript" and process.args_count == 3) or 
   (process.args == "osascript" and process.args_count == 1))]
Raw source Curl Output Piped to Osascript · Elastic TOML
Esc
Published by elastic/protections-artifacts ↗, licensed under Elastic License 2.0 ↗. Reproduced here unmodified.
[rule]
description = """
Detects when curl or nscurl is executed followed by osascript execution within 15 seconds from the same parent process.
This pattern indicates potential malicious workflows where curl output is being piped to osascript for AppleScript
execution, commonly used for payload downloads and immediate execution or C2 communication.
"""
id = "d8a84851-53ac-42ba-8c41-dd16fda7e9da"
license = "Elastic License v2"
name = "Curl Output Piped to Osascript"
os_list = ["macos"]
version = "1.0.4"

query = '''
sequence by process.parent.entity_id with maxspan=20s
[process where event.type == "start" and event.action == "exec" and
  process.name in ("curl", "nscurl") and process.parent.name in ("bash", "sh", "zsh")]
[process where event.type == "start" and event.action == "exec" and 
  ((process.args == "osascript" and process.args == "-l" and process.args == "JavaScript" and process.args_count == 3) or 
   (process.args == "osascript" and process.args_count == 1))]
'''

min_endpoint_version = "8.16.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.002"
name = "AppleScript"
reference = "https://attack.mitre.org/techniques/T1059/002/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1105"
name = "Ingress Tool Transfer"
reference = "https://attack.mitre.org/techniques/T1105/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "8.16.0"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.