Detectionmediumtest

Potential In-Memory Download And Compile Of Payloads

Detects potential in-memory downloading and compiling of applets using curl and osacompile as seen used by XCSSET malware

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Sohan G (D4rkCiph3r), Red CanaryCreated Tue Aug 2213db8d2e-7723-4c2c-93c1-a4d36994f7efmacos

Log Source

macOSProcess Creation

ProductmacOS← raw: macos

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection:
        CommandLine|contains|all:
            - 'osacompile'
            - 'curl'
    condition: selection

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

MITRE ATT&CK

Tactics

Techniques

Sub-techniques

Rule Metadata

Rule ID

13db8d2e-7723-4c2c-93c1-a4d36994f7ef

Status

test

Level

medium

Type

Detection

Created

Tue Aug 22

Author

Path

rules/macos/process_creation/proc_creation_macos_susp_in_memory_download_and_compile.yml

Raw Tags

attack.command-and-controlattack.executionattack.t1059.007attack.t1105