{"id":"13db8d2e-7723-4c2c-93c1-a4d36994f7ef","title":"Potential In-Memory Download And Compile Of Payloads","description":"Detects potential in-memory downloading and compiling of applets using curl and osacompile as seen used by XCSSET malware","author":"Sohan G (D4rkCiph3r), Red Canary (idea)","status":"test","level":"medium","date":"2023-08-22","modified":"","tags":["attack.command-and-control","attack.execution","attack.t1059.007","attack.t1105"],"technique_ids":["T1059.007","T1105"],"logsource":{"category":"process_creation","product":"macos"},"falsepositives":["Unknown"],"references":["https://redcanary.com/blog/mac-application-bundles/"],"source_path":"rules/macos/process_creation/proc_creation_macos_susp_in_memory_download_and_compile.yml","source_sha256":"68d652f778647a21fac8049f2c62c8d482a0d521158af1a12d3eada59e17dbd5","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_susp_in_memory_download_and_compile.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential In-Memory Download And Compile Of Payloads\nid: 13db8d2e-7723-4c2c-93c1-a4d36994f7ef\nstatus: test\ndescription: Detects potential in-memory downloading and compiling of applets using curl and osacompile as seen used by XCSSET malware\nreferences:\n    - https://redcanary.com/blog/mac-application-bundles/\nauthor: Sohan G (D4rkCiph3r), Red Canary (idea)\ndate: 2023-08-22\ntags:\n    - attack.command-and-control\n    - attack.execution\n    - attack.t1059.007\n    - attack.t1105\nlogsource:\n    category: process_creation\n    product: macos\ndetection:\n    selection:\n        CommandLine|contains|all:\n            - 'osacompile'\n            - 'curl'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.007","id":"T1059.007","name":"JavaScript","page":"techniques/enterprise/T1059.007/"},{"key":"enterprise/T1105","id":"T1105","name":"Ingress Tool Transfer","page":"techniques/enterprise/T1105/"}],"data_path":"data/detection-rules/13db8d2e-7723-4c2c-93c1-a4d36994f7ef.json","kind":"sigma"}