macOS In-Memory Download and Compile via curl and osacompile

Alerts when macOS processes include both curl and osacompile, consistent with downloading and compiling payloads.

FreeUnreviewedSigmamediumv1

macos-in-memory-download-and-compile-via-curl-and-osacompile-13db8d2e

title: macOS In-Memory Download and Compile via curl and osacompile
id: 87320a26-9737-4f67-a4aa-98b8f113bea8
status: test
description: This rule flags macOS process executions where the command line contains both curl and osacompile. The combination suggests an attacker may download an applet payload and compile it locally to enable in-memory or short-lived execution. It relies on process creation telemetry that records command-line arguments for running processes.
references:
  - https://redcanary.com/blog/mac-application-bundles/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_susp_in_memory_download_and_compile.yml
author: Sohan G (D4rkCiph3r), Red Canary (idea), Huntrule Team
date: 2023-08-22
tags:
  - attack.command-and-control
  - attack.execution
  - attack.t1059.007
  - attack.t1105
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    CommandLine|contains|all:
      - osacompile
      - curl
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 13db8d2e-7723-4c2c-93c1-a4d36994f7ef
    type: derived

What it detects

This rule flags macOS process executions where the command line contains both curl and osacompile. The combination suggests an attacker may download an applet payload and compile it locally to enable in-memory or short-lived execution. It relies on process creation telemetry that records command-line arguments for running processes.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.