macOS Installer Scripts Spawning Suspicious Interpreter Child Processes
Alerts when macOS installer scripts (preinstall/postinstall) spawn shell, scripting, osascript, curl, or wget processes.
- Product
- macos
- Category
- process_creation
- Author
- Sohan G (D4rkCiph3r) (SigmaHQ), DRL 1.1
- Published
- 2023-02-18
- Updated
- 2026-07-31
ATT&CK techniques
Execution → C2Recon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule identifies child process execution where the parent is an installer-related script (a process ending with /package_script_service or /installer) and the child executable is a common interpreter or downloader. It focuses on installer phases by matching command lines containing preinstall or postinstall. Such behavior matters because malicious software can use installer script execution to launch payloads or external fetching tools. The detection relies on macOS process creation telemetry including parent/child image paths and command-line content.
Reporting behind it
- redcanary.comhttps://redcanary.com/blog/clipping-silver-sparrows-wings/
- github.comhttps://github.com/elastic/detection-rules/blob/4312d8c9583be524578a14fe6295c3370b9a9307/rules/macos/execution_installer_package_spawned_network_event.toml
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_installer_susp_child_process.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: macOS Installer Scripts Spawning Suspicious Interpreter Child Processes
id: 8a028353-34e0-42ec-8b0c-3d9ec2e84eee
status: test
description: This rule identifies child process execution where the parent is an installer-related script (a process ending with /package_script_service or /installer) and the child executable is a common interpreter or downloader. It focuses on installer phases by matching command lines containing preinstall or postinstall. Such behavior matters because malicious software can use installer script execution to launch payloads or external fetching tools. The detection relies on macOS process creation telemetry including parent/child image paths and command-line content.
references:
- https://redcanary.com/blog/clipping-silver-sparrows-wings/
- https://github.com/elastic/detection-rules/blob/4312d8c9583be524578a14fe6295c3370b9a9307/rules/macos/execution_installer_package_spawned_network_event.toml
- https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_installer_susp_child_process.yml
author: Sohan G (D4rkCiph3r), Huntrule Team
date: 2023-02-18
tags:
- attack.t1059
- attack.t1059.007
- attack.t1071
- attack.t1071.001
- attack.execution
- attack.command-and-control
logsource:
category: process_creation
product: macos
detection:
selection_installer:
ParentImage|endswith:
- /package_script_service
- /installer
Image|endswith:
- /sh
- /bash
- /dash
- /python
- /ruby
- /perl
- /php
- /javascript
- /osascript
- /tclsh
- /curl
- /wget
CommandLine|contains:
- preinstall
- postinstall
condition: selection_installer
falsepositives:
- Legitimate software uses the scripts (preinstall, postinstall)
level: medium
license: DRL-1.1
related:
- id: e0cfaecd-602d-41af-988d-f6ccebb2af26
type: derived