huntrule

macOS Process Creation: nscurl File Download Arguments

Flags nscurl executions on macOS that include download-oriented command-line options, indicating potential remote file retrieval.

FreeReviewedSigma · Medium · v2
Product
macos
Category
process_creation
Author
Daniel Cortez (SigmaHQ), DRL 1.1
Published
2024-06-04
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

C2

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags process executions of the nscurl utility on macOS when command-line arguments indicate a file download operation (for example, --download, --download-directory, or output-related flags). Attackers may use nscurl to retrieve remote payloads or content as part of command-and-control or staging. It relies on process creation telemetry with the executable path ending in /nscurl and the presence of specific download-related substrings in the command line.

Reporting behind it

Related detections9 linkedT1105 — drag to rearrange
Suspicious Executable Download from Compromised CMS Client Scripts Path (via proxy)
Suspicious HijackLoader PNG Payload Retrieval via ClearFake
Malicious Download Piped to Shell via curl or wget (via process_creation)
Suspicious File Download via busybox ftpget (via process_creation)
Malicious ActiveMQ CVE-2023-46604 Payload Download via curl or wget
Suspicious PowerShell Download Cradle to Blogspot (via process_creation)
Suspicious Hidden PowerShell WebClient DownloadFile Cradle
Suspicious PowerShell Download Cradle with Spoofed User-Agent via MSIX
Malicious PowerShell In-Memory Download Cradle via Script Block (via ps_script)
macOS Process Creation: nscurl File Download Arguments
Pivot detection · T1105 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.