huntrule

macOS XCSSET Infection Indicators from bash-launched curl, osacompile, plutil, and zip

Flags macOS process chains involving bash-driven curl plus osacompile/plutil/zip operations targeting user and Group Containers paths.

FreeUnreviewedSigmamediumv1
title: macOS XCSSET Infection Indicators from bash-launched curl, osacompile, plutil, and zip
id: 43abe2f4-baeb-4f19-85ba-fbf49189c282
status: test
description: This rule identifies process creation patterns consistent with XCSSET malware activity on macOS, including bash-launched curl requests and compilation or packaging steps targeting user and Library Group Containers paths. Such chained execution can indicate malware fetching remote resources and modifying applications or related components for persistence and theft. It relies on process creation telemetry capturing executable paths and command-line arguments for curl, osacompile, plutil, and zip spawned by bash.
references:
  - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-f5deb07688e1a8dec9530bc3071967b2da5c16b482e671812b864c37beb28f08
  - https://malpedia.caad.fkie.fraunhofer.de/details/osx.xcsset
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_xcsset_malware_infection.yml
author: Tim Rauch (rule), Elastic (idea), Huntrule Team
date: 2022-10-17
tags:
  - attack.command-and-control
logsource:
  category: process_creation
  product: macos
detection:
  selection_1_curl:
    ParentImage|endswith: /bash
    Image|endswith: /curl
    CommandLine|contains:
      - /sys/log.php
      - /sys/prepod.php
      - /sys/bin/Pods
  selection_1_https:
    CommandLine|contains: https://
  selection_other_1:
    ParentImage|endswith: /bash
    Image|endswith: /osacompile
    CommandLine|contains|all:
      - /Users/
      - /Library/Group Containers/
  selection_other_2:
    ParentImage|endswith: /bash
    Image|endswith: /plutil
    CommandLine|contains|all:
      - LSUIElement
      - /Users/
      - /Library/Group Containers/
  selection_other_3:
    Image|endswith: /zip
    CommandLine|contains|all:
      - -r
      - /Users/
      - /Library/Group Containers/
  condition: all of selection_1_* or 1 of selection_other_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 47d65ac0-c06f-4ba2-a2e3-d263139d0f51
    type: derived

What it detects

This rule identifies process creation patterns consistent with XCSSET malware activity on macOS, including bash-launched curl requests and compilation or packaging steps targeting user and Library Group Containers paths. Such chained execution can indicate malware fetching remote resources and modifying applications or related components for persistence and theft. It relies on process creation telemetry capturing executable paths and command-line arguments for curl, osacompile, plutil, and zip spawned by bash.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.