Curl Execution via Shell Profile

  1[metadata]
  2creation_date = "2026/01/30"
  3integration = ["endpoint"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects when curl is executed via a shell profile upon login. This indicates a curl command was added to the 
 11user's shell profile (like .zshrc or .bashrc) and is executed automatically at login, which could be used for 
 12persistence and payload delivery.
 13"""
 14from = "now-9m"
 15index = ["logs-endpoint.events.process-*"]
 16language = "eql"
 17license = "Elastic License v2"
 18name = "Curl Execution via Shell Profile"
 19risk_score = 73
 20rule_id = "afdca1e0-0f8a-4fcf-9e1e-95e09791e3cd"
 21severity = "high"
 22tags = [
 23    "Domain: Endpoint",
 24    "OS: macOS",
 25    "Use Case: Threat Detection",
 26    "Tactic: Persistence",
 27    "Tactic: Command and Control",
 28    "Data Source: Elastic Defend",
 29    "Resources: Investigation Guide",
 30    "Noise: Low",
 31    "Performance: Normal",
 32    "Profile: Recommended",
 33    "Threat: Download Tool Abuse",
 34    "Rule Type: Event Correlation (EQL)",
 35    "Platform: macOS",
 36]
 37type = "eql"
 38note = """## Triage and analysis
 39
 40> **Disclaimer**:
 41> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 42
 43### Investigating Curl Execution via Shell Profile
 44
 45Shell profile scripts (.zshrc, .bashrc, .bash_profile, .zprofile) execute automatically when users open new terminal sessions, making them valuable persistence mechanisms. Threat actors inject curl commands into these profiles to download and execute additional payloads each time the user opens a terminal, creating a reliable beacon mechanism that persists across system reboots. This detection rule identifies curl execution with download flags that originates directly from shell profile execution at login.
 46
 47### Possible investigation steps
 48
 49- Review the shell profile files (.zshrc, .bashrc, .bash_profile, .zprofile) for the affected user to identify the injected curl command and its destination URL.
 50- Analyze the process.args to determine the full curl command including output destination (-o, --output) and any other flags used.
 51- Investigate the destination URL in threat intelligence databases to determine if it is associated with known malicious infrastructure.
 52- Review the file modification timestamps of the shell profile files to determine when the malicious entry was added.
 53- Check browser history, email attachments, and download logs to understand how the attacker initially gained access to modify the profile.
 54- Examine the user.name associated with the modified profile to assess the scope of potential data access.
 55- Search for downloaded files on the system that may have been retrieved by the curl command and analyze their contents.
 56
 57### False positive analysis
 58
 59- Developers may add curl commands to shell profiles for convenience, such as fetching daily updates or checking API endpoints. Verify the URL destination and purpose with the user.
 60- Some shell customization frameworks and plugins use curl to update themselves on shell startup. Review common frameworks like Oh My Zsh for expected behavior.
 61- Enterprise tools may configure shell profiles for authentication or environment setup. Confirm with IT operations if such configurations are expected.
 62- Elastic infrastructure URLs are already excluded in the query to reduce noise from legitimate Elastic tooling.
 63
 64### Response and remediation
 65
 66- Remove the malicious curl command from the affected shell profile file immediately.
 67- Block the destination URL at the network perimeter to prevent payload delivery.
 68- Search for any files that were downloaded by the curl command and quarantine or remove them.
 69- Review user credentials and tokens that may have been exposed, as shell sessions often contain sensitive environment variables.
 70- Investigate how the shell profile was modified to identify the initial access vector.
 71- Check other user accounts on the system for similar shell profile modifications.
 72- Reset the user's shell profile from a known-good backup or template if available.
 73- Monitor for curl execution from shell profiles across the environment to identify additional compromised systems.
 74"""
 75query = '''
 76sequence with maxspan=10s
 77  [process where host.os.type == "macos" and event.type == "start" and event.action == "exec" and
 78    process.name in ("bash", "zsh", "sh") and
 79    process.args in ("-zsh", "-sh", "-bash") and process.args_count == 1 and
 80    process.parent.name == "login"] by process.entity_id
 81  [process where host.os.type == "macos" and event.type == "start" and event.action == "exec" and
 82    process.name in ("curl", "nscurl") and
 83    process.args in ("-o", "--output", "--download", "-dl", "-dir", "--directory", "-F", "--form") and
 84    not process.args like ("https://upload.elastic.co*", "https://vault-ci-prod.elastic.dev", "https://artifacts.elastic.co*")] by process.parent.entity_id
 85'''
 86
 87[[rule.threat]]
 88framework = "MITRE ATT&CK"
 89
 90[[rule.threat.technique]]
 91id = "T1546"
 92name = "Event Triggered Execution"
 93reference = "https://attack.mitre.org/techniques/T1546/"
 94
 95[[rule.threat.technique.subtechnique]]
 96id = "T1546.004"
 97name = "Unix Shell Configuration Modification"
 98reference = "https://attack.mitre.org/techniques/T1546/004/"
 99
100[rule.threat.tactic]
101id = "TA0003"
102name = "Persistence"
103reference = "https://attack.mitre.org/tactics/TA0003/"
104
105[[rule.threat]]
106framework = "MITRE ATT&CK"
107
108[[rule.threat.technique]]
109id = "T1105"
110name = "Ingress Tool Transfer"
111reference = "https://attack.mitre.org/techniques/T1105/"
112
113[rule.threat.tactic]
114id = "TA0011"
115name = "Command and Control"
116reference = "https://attack.mitre.org/tactics/TA0011/"
117
118[[rule.threat]]
119framework = "MITRE ATT&CK"
120
121[[rule.threat.technique]]
122id = "T1059"
123name = "Command and Scripting Interpreter"
124reference = "https://attack.mitre.org/techniques/T1059/"
125
126[[rule.threat.technique.subtechnique]]
127id = "T1059.004"
128name = "Unix Shell"
129reference = "https://attack.mitre.org/techniques/T1059/004/"
130
131[rule.threat.tactic]
132id = "TA0002"
133name = "Execution"
134reference = "https://attack.mitre.org/tactics/TA0002/"