macOS XCSSET Execution Indicators via bash-launched curl, osacompile, plutil, or zip
Flags macOS process chains involving bash-driven curl plus osacompile/plutil/zip operations targeting user and Group Containers paths.
- Product
- macos
- Category
- process_creation
- Author
- Tim Rauch (rule), Elastic (idea) (SigmaHQ), DRL 1.1
- Published
- 2022-10-17
- Updated
- 2026-07-31
What it detects
This rule identifies process execution patterns consistent with XCSSET malware activity on macOS, including bash-launched curl fetching specific script paths over HTTPS and build/modification steps using osacompile, plutil, and zip targeting Group Containers under /Users/. Such behavior matters because it reflects scripted payload retrieval and subsequent application tampering in the user environment. The detection relies on process creation telemetry capturing ParentImage, Image path suffixes, and CommandLine substrings.
Reporting behind it
- github.comhttps://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-f5deb07688e1a8dec9530bc3071967b2da5c16b482e671812b864c37beb28f08
- malpedia.caad.fkie.fraunhofer.dehttps://malpedia.caad.fkie.fraunhofer.de/details/osx.xcsset
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_xcsset_malware_infection.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: macOS XCSSET Execution Indicators via bash-launched curl, osacompile, plutil, or zip
id: 43abe2f4-baeb-4f19-85ba-fbf49189c282
status: test
description: This rule identifies process execution patterns consistent with XCSSET malware activity on macOS, including bash-launched curl fetching specific script paths over HTTPS and build/modification steps using osacompile, plutil, and zip targeting Group Containers under /Users/. Such behavior matters because it reflects scripted payload retrieval and subsequent application tampering in the user environment. The detection relies on process creation telemetry capturing ParentImage, Image path suffixes, and CommandLine substrings.
references:
- https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-f5deb07688e1a8dec9530bc3071967b2da5c16b482e671812b864c37beb28f08
- https://malpedia.caad.fkie.fraunhofer.de/details/osx.xcsset
- https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_xcsset_malware_infection.yml
author: Tim Rauch (rule), Elastic (idea), Huntrule Team
date: 2022-10-17
tags:
- attack.command-and-control
logsource:
category: process_creation
product: macos
detection:
selection_1_curl:
ParentImage|endswith: /bash
Image|endswith: /curl
CommandLine|contains:
- /sys/log.php
- /sys/prepod.php
- /sys/bin/Pods
selection_1_https:
CommandLine|contains: https://
selection_other_1:
ParentImage|endswith: /bash
Image|endswith: /osacompile
CommandLine|contains|all:
- /Users/
- /Library/Group Containers/
selection_other_2:
ParentImage|endswith: /bash
Image|endswith: /plutil
CommandLine|contains|all:
- LSUIElement
- /Users/
- /Library/Group Containers/
selection_other_3:
Image|endswith: /zip
CommandLine|contains|all:
- -r
- /Users/
- /Library/Group Containers/
condition: all of selection_1_* or 1 of selection_other_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 47d65ac0-c06f-4ba2-a2e3-d263139d0f51
type: derived