macOS Process Creation: nscurl File Download Arguments
Flags nscurl executions on macOS that include download-oriented command-line options, indicating potential remote file retrieval.
- Product
- macos
- Category
- process_creation
- Author
- Daniel Cortez (SigmaHQ), DRL 1.1
- Published
- 2024-06-04
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags process executions of the nscurl utility on macOS when command-line arguments indicate a file download operation (for example, --download, --download-directory, or output-related flags). Attackers may use nscurl to retrieve remote payloads or content as part of command-and-control or staging. It relies on process creation telemetry with the executable path ending in /nscurl and the presence of specific download-related substrings in the command line.
Reporting behind it
- loobins.iohttps://www.loobins.io/binaries/nscurl/
- agnosticdev.comhttps://www.agnosticdev.com/content/how-diagnose-app-transport-security-issues-using-nscurl-and-openssl
- gist.github.comhttps://gist.github.com/nasbench/ca6ef95db04ae04ffd1e0b1ce709cadd
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_nscurl_usage.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "macOS Process Creation: nscurl File Download Arguments"
id: 4aceaad4-16c2-4a3b-825d-b1ab1caf498c
status: test
description: This rule flags process executions of the nscurl utility on macOS when command-line arguments indicate a file download operation (for example, --download, --download-directory, or output-related flags). Attackers may use nscurl to retrieve remote payloads or content as part of command-and-control or staging. It relies on process creation telemetry with the executable path ending in /nscurl and the presence of specific download-related substrings in the command line.
references:
- https://www.loobins.io/binaries/nscurl/
- https://www.agnosticdev.com/content/how-diagnose-app-transport-security-issues-using-nscurl-and-openssl
- https://gist.github.com/nasbench/ca6ef95db04ae04ffd1e0b1ce709cadd
- https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_nscurl_usage.yml
author: Daniel Cortez, Huntrule Team
date: 2024-06-04
tags:
- attack.command-and-control
- attack.t1105
logsource:
category: process_creation
product: macos
detection:
selection:
Image|endswith: /nscurl
CommandLine|contains:
- "--download "
- "--download-directory "
- "--output "
- "-dir "
- "-dl "
- -ld
- "-o "
condition: selection
falsepositives:
- Legitimate usage of nscurl by administrators and users.
level: medium
license: DRL-1.1
related:
- id: 6d8a7cf1-8085-423b-b87d-7e880faabbdf
type: derived