Suspicious Curl from macOS Application

  1[metadata]
  2creation_date = "2026/01/30"
  3integration = ["endpoint"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects the use of curl by a macOS application binary to connect to a raw IP URI and download a second 
 11stage payload. Threat actors often utilize a benign looking or legitimate application as a first stage 
 12dropper. Curl is commonly used as it doesn't enforce Gatekeeper checks.
 13"""
 14from = "now-9m"
 15index = ["logs-endpoint.events.process-*"]
 16language = "eql"
 17license = "Elastic License v2"
 18name = "Suspicious Curl from macOS Application"
 19references = [
 20    "https://objective-see.org/blog/blog_0x71.html#-vpn-trojan-covid",
 21    "https://attack.mitre.org/techniques/T1105/"
 22]
 23risk_score = 73
 24rule_id = "6da6f80f-fe41-4814-8010-453e6164bd40"
 25severity = "high"
 26tags = [
 27    "Domain: Endpoint",
 28    "OS: macOS",
 29    "Use Case: Threat Detection",
 30    "Tactic: Command and Control",
 31    "Data Source: Elastic Defend",
 32    "Resources: Investigation Guide",
 33    "Noise: Medium",
 34    "Performance: Normal",
 35    "Profile: Recommended",
 36    "Threat: Download Tool Abuse",
 37    "Rule Type: Event Correlation (EQL)",
 38    "Platform: macOS",
 39]
 40timestamp_override = "event.ingested"
 41type = "eql"
 42note = """## Triage and analysis
 43
 44> **Disclaimer**:
 45> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 46
 47### Investigating Suspicious Curl from macOS Application
 48
 49Trojanized macOS applications often use curl to download second-stage payloads from attacker-controlled infrastructure. By leveraging curl instead of direct downloads, these malicious applications can bypass Gatekeeper quarantine checks and evade built-in macOS security mechanisms. This detection rule identifies when applications from the /Applications directory spawn curl to connect to raw IP addresses, which is highly indicative of malicious payload retrieval activity.
 50
 51### Possible investigation steps
 52
 53- Review the process.Ext.effective_parent.executable field to identify which application spawned the curl process and assess whether this application is expected to make network downloads.
 54- Examine the process.args fields to extract the destination IP address and URL path being accessed, and research these indicators in threat intelligence databases.
 55- Analyze the process.parent.command_line to understand the full context of how curl was invoked, including any output file paths that may indicate where payloads were written.
 56- Check the code signature of the parent application using the process.code_signature fields to determine if it is validly signed and if the signature matches known good versions.
 57- Investigate the origin of the suspicious application by reviewing installation logs, download history, and any recent DMG or PKG files that may have delivered the trojanized application.
 58- Search for any files created on disk around the time of the curl execution to identify downloaded payloads that may have been staged for execution.
 59- Correlate with other events on the same host to identify if the downloaded payload was subsequently executed.
 60
 61### False positive analysis
 62
 63- Some legitimate applications may use curl for software updates or telemetry data collection. Verify the destination IP against the application vendor's known infrastructure.
 64- Development tools and IDEs may download dependencies or packages via curl during normal operations. Review the context and confirm with development teams.
 65- Homebrew and package managers may spawn curl from application contexts during installations. Verify if package management activities were expected.
 66- Add verified legitimate applications to the exclusion list in the query after confirming their behavior is expected.
 67
 68### Response and remediation
 69
 70- Immediately quarantine the suspicious application by moving it to a secure location and removing it from /Applications to prevent further execution.
 71- Block the destination IP address at the network perimeter and on endpoint firewalls to prevent additional downloads.
 72- Search the file system for any payloads that may have been downloaded and quarantine them for analysis.
 73- Conduct a full malware scan on the affected system to identify any persistence mechanisms or additional malware components.
 74- Report the trojanized application to Apple Security and relevant threat intelligence sharing platforms.
 75- Review other systems in the environment for the same trojanized application to determine the scope of potential compromise.
 76- Investigate the delivery mechanism to understand how the trojanized application was installed and prevent future infections.
 77"""
 78query = '''
 79process where host.os.type == "macos" and event.type == "start" and event.action == "exec" and 
 80  process.name in ("curl", "nscurl") and 
 81  process.args in ("-o", "--output", "--download", "-dl", "-dir", "--directory") and
 82  process.args regex~ """https?:\/\/[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}(:[0-9]{1,5})?\/.*""" and 
 83  process.parent.name like~ ("bash", "sh", "zsh", "osascript", "tclsh*", "python*") and
 84  process.Ext.effective_parent.executable like "/Applications/*" and
 85  process.args_count <= 10 and 
 86  not process.args like "/Applications/*" and
 87  not process.Ext.effective_parent.executable in ("/Applications/iTerm.app/Contents/MacOS/iTerm2",
 88                                                   "/Applications/Visual Studio Code.app/Contents/MacOS/Electron", 
 89                                                   "/Applications/Warp.app/Contents/MacOS/stable")
 90'''
 91
 92[[rule.threat]]
 93framework = "MITRE ATT&CK"
 94
 95[[rule.threat.technique]]
 96id = "T1071"
 97name = "Application Layer Protocol"
 98reference = "https://attack.mitre.org/techniques/T1071/"
 99
100[[rule.threat.technique.subtechnique]]
101id = "T1071.001"
102name = "Web Protocols"
103reference = "https://attack.mitre.org/techniques/T1071/001/"
104
105[[rule.threat.technique]]
106id = "T1105"
107name = "Ingress Tool Transfer"
108reference = "https://attack.mitre.org/techniques/T1105/"
109
110[rule.threat.tactic]
111id = "TA0011"
112name = "Command and Control"
113reference = "https://attack.mitre.org/tactics/TA0011/"
114
115[[rule.threat]]
116framework = "MITRE ATT&CK"
117
118[[rule.threat.technique]]
119id = "T1553"
120name = "Subvert Trust Controls"
121reference = "https://attack.mitre.org/techniques/T1553/"
122
123[[rule.threat.technique.subtechnique]]
124id = "T1553.001"
125name = "Gatekeeper Bypass"
126reference = "https://attack.mitre.org/techniques/T1553/001/"
127
128[rule.threat.tactic]
129id = "TA0005"
130name = "Defense Evasion"
131reference = "https://attack.mitre.org/tactics/TA0005/"