macOS Installer Script Spawning Suspicious Child Interpreter Processes

title: macOS Installer Script Spawning Suspicious Child Interpreter Processes
id: 8a028353-34e0-42ec-8b0c-3d9ec2e84eee
status: test
description: This rule flags process creation where a macOS installer-related parent launches a child interpreter or shell process. It targets cases where installer script phases (preinstall or postinstall) run unexpected tooling such as osascript/JXA-like interpreters, scripting languages, curl, or wget. This behavior matters because malicious installers often use embedded scripts to start payloads or stage downloads. The detection relies on macOS process creation telemetry, matching parent executable path suffixes, child executable path suffixes, and command-line strings indicating installer script phases.
references:
  - https://redcanary.com/blog/clipping-silver-sparrows-wings/
  - https://github.com/elastic/detection-rules/blob/4312d8c9583be524578a14fe6295c3370b9a9307/rules/macos/execution_installer_package_spawned_network_event.toml
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_installer_susp_child_process.yml
author: Sohan G (D4rkCiph3r), Huntrule Team
date: 2023-02-18
tags:
  - attack.t1059
  - attack.t1059.007
  - attack.t1071
  - attack.t1071.001
  - attack.execution
  - attack.command-and-control
logsource:
  category: process_creation
  product: macos
detection:
  selection_installer:
    ParentImage|endswith:
      - /package_script_service
      - /installer
    Image|endswith:
      - /sh
      - /bash
      - /dash
      - /python
      - /ruby
      - /perl
      - /php
      - /javascript
      - /osascript
      - /tclsh
      - /curl
      - /wget
    CommandLine|contains:
      - preinstall
      - postinstall
  condition: selection_installer
falsepositives:
  - Legitimate software uses the scripts (preinstall, postinstall)
level: medium
license: DRL-1.1
related:
  - id: e0cfaecd-602d-41af-988d-f6ccebb2af26
    type: derived