File Download Via Nscurl - MacOS — Sigma Rule

Rule metadata and linked tags

Author: Daniel Cortez. Source status: test; severity: medium. Source dates: 2024-06-04 / not supplied.

{
  "category": "process_creation",
  "product": "macos"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 27e3fe536f49d4a366eac97f69dc409e3ac2f7e522a6effb1966ff5e7411c268

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: File Download Via Nscurl - MacOS
id: 6d8a7cf1-8085-423b-b87d-7e880faabbdf
status: test
description: Detects the execution of the nscurl utility in order to download files.
references:
    - https://www.loobins.io/binaries/nscurl/
    - https://www.agnosticdev.com/content/how-diagnose-app-transport-security-issues-using-nscurl-and-openssl
    - https://gist.github.com/nasbench/ca6ef95db04ae04ffd1e0b1ce709cadd
author: Daniel Cortez
date: 2024-06-04
tags:
    - attack.command-and-control
    - attack.t1105
logsource:
    category: process_creation
    product: macos
detection:
    selection:
        Image|endswith: '/nscurl'
        CommandLine|contains:
            - '--download '
            - '--download-directory '
            - '--output '
            - '-dir '
            - '-dl '
            - '-ld'
            - '-o '
    condition: selection
falsepositives:
    - Legitimate usage of nscurl by administrators and users.
level: medium

Original YAML and metadata in JSON

False positives

• Legitimate usage of nscurl by administrators and users.

Source references

• https://www.loobins.io/binaries/nscurl/
• https://www.agnosticdev.com/content/how-diagnose-app-transport-security-issues-using-nscurl-and-openssl
• https://gist.github.com/nasbench/ca6ef95db04ae04ffd1e0b1ce709cadd