macOS Process Execution Indicators for WizardUpdate-Associated Malware

title: macOS Process Execution Indicators for WizardUpdate-Associated Malware
id: bbb5ffc8-b6f8-4fe5-bf6c-8633e9d422ef
status: test
description: This rule matches process creation telemetry consistent with WizardUpdate-associated malicious execution on macOS, including a shell script invoking curl with command substitution and an eval step. It also looks for curl execution containing an intermediate agent marker. These patterns matter because they reflect staging and download/command execution behavior commonly used by trojans to infiltrate systems and enable follow-on payloads. The detection relies on macOS process creation fields, specifically the executable path and the full command line content.
references:
  - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-c68a1fcbf7a3f80c87225d7fdc031f691e9f3b6a14a36754be00762bfe6eae97
  - https://malpedia.caad.fkie.fraunhofer.de/details/osx.xcsset
  - https://www.microsoft.com/security/blog/2022/02/02/the-evolution-of-a-mac-trojan-updateagents-progression/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_wizardupdate_malware_infection.yml
author: Tim Rauch (rule), Elastic (idea), Huntrule Team
date: 2022-10-17
tags:
  - attack.command-and-control
logsource:
  category: process_creation
  product: macos
detection:
  selection_1:
    Image|endswith: /sh
    CommandLine|contains|all:
      - "=$(curl "
      - eval
  selection_2:
    Image|endswith: /curl
    CommandLine|contains: _intermediate_agent_
  condition: 1 of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: f68c4a4f-19ef-4817-952c-50dce331f4b0
    type: derived