macOS Process Execution Traces Indicating WizardUpdate Downloader/C2 Staging
Flags macOS process creations showing curl+eval execution and intermediate agent indicators associated with WizardUpdate activity.
- Product
- macos
- Category
- process_creation
- Author
- Tim Rauch (rule), Elastic (idea) (SigmaHQ), DRL 1.1
- Published
- 2022-10-17
- Updated
- 2026-07-31
What it detects
This rule identifies macOS process execution patterns consistent with WizardUpdate activity, specifically shell and curl commands involved in staged execution. Attackers commonly use these staging behaviors to fetch payload components and chain execution via shell evaluation, increasing the likelihood of additional malicious payloads. Telemetry relies on process creation events containing executable paths and command-line content matching the defined curl/sh patterns.
Reporting behind it
- github.comhttps://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-c68a1fcbf7a3f80c87225d7fdc031f691e9f3b6a14a36754be00762bfe6eae97
- malpedia.caad.fkie.fraunhofer.dehttps://malpedia.caad.fkie.fraunhofer.de/details/osx.xcsset
- microsoft.comhttps://www.microsoft.com/security/blog/2022/02/02/the-evolution-of-a-mac-trojan-updateagents-progression/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_wizardupdate_malware_infection.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: macOS Process Execution Traces Indicating WizardUpdate Downloader/C2 Staging
id: bbb5ffc8-b6f8-4fe5-bf6c-8633e9d422ef
status: test
description: This rule identifies macOS process execution patterns consistent with WizardUpdate activity, specifically shell and curl commands involved in staged execution. Attackers commonly use these staging behaviors to fetch payload components and chain execution via shell evaluation, increasing the likelihood of additional malicious payloads. Telemetry relies on process creation events containing executable paths and command-line content matching the defined curl/sh patterns.
references:
- https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-c68a1fcbf7a3f80c87225d7fdc031f691e9f3b6a14a36754be00762bfe6eae97
- https://malpedia.caad.fkie.fraunhofer.de/details/osx.xcsset
- https://www.microsoft.com/security/blog/2022/02/02/the-evolution-of-a-mac-trojan-updateagents-progression/
- https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_wizardupdate_malware_infection.yml
author: Tim Rauch (rule), Elastic (idea), Huntrule Team
date: 2022-10-17
tags:
- attack.command-and-control
logsource:
category: process_creation
product: macos
detection:
selection_1:
Image|endswith: /sh
CommandLine|contains|all:
- "=$(curl "
- eval
selection_2:
Image|endswith: /curl
CommandLine|contains: _intermediate_agent_
condition: 1 of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: f68c4a4f-19ef-4817-952c-50dce331f4b0
type: derived