Suspicious Installer Package Child Process (via process_creation)

title: Suspicious Installer Package Child Process (via process_creation)
id: 0538c88a-05c1-5298-873e-1a195fe02f30
status: stable
description: This rule detects the execution of anomalous child processes from macOS installer package parent process. This includes osascript, JXA, curl and wget amongst other interpreters
references:
    - https://attack.mitre.org/techniques/T1071/001/
    - https://attack.mitre.org/techniques/T1071/
    - https://attack.mitre.org/techniques/T1059/007/
    - https://attack.mitre.org/techniques/T1059/
    - https://redcanary.com/blog/clipping-silver-sparrows-wings/
    - https://github.com/elastic/detection-rules/blob/4312d8c9583be524578a14fe6295c3370b9a9307/rules/macos/execution_installer_package_spawned_network_event.toml
author: Huntrule Team
date: 2026-04-05
tags:
    - attack.t1059
    - attack.t1059.007
    - attack.t1071
    - attack.t1071.001
    - attack.execution
    - attack.command-and-control
logsource:
    category: process_creation
    product: macos
detection:
    selection_installer:
        ParentImage|endswith:
            - '/package_script_service'
            - '/installer'
        Image|endswith:
            - '/sh'
            - '/bash'
            - '/dash'
            - '/python'
            - '/ruby'
            - '/perl'
            - '/php'
            - '/javascript'
            - '/osascript'
            - '/tclsh'
            - '/curl'
            - '/wget'
        CommandLine|contains:
            - 'preinstall'
            - 'postinstall'
    condition: selection_installer
falsepositives:
    - Unknown
level: medium