File Download Via Nscurl - MacOS

calendar Apr 28, 2026 · attack.command-and-control attack.t1105  ·
Share on: linkedin copy

Detects the execution of the nscurl utility in order to download files.

Sigma rule (View on GitHub)

 1title: File Download Via Nscurl - MacOS
 2id: 6d8a7cf1-8085-423b-b87d-7e880faabbdf
 3status: test
 4description: Detects the execution of the nscurl utility in order to download files.
 5references:
 6    - https://www.loobins.io/binaries/nscurl/
 7    - https://www.agnosticdev.com/content/how-diagnose-app-transport-security-issues-using-nscurl-and-openssl
 8    - https://gist.github.com/nasbench/ca6ef95db04ae04ffd1e0b1ce709cadd
 9author: Daniel Cortez
10date: 2024-06-04
11tags:
12    - attack.command-and-control
13    - attack.t1105
14logsource:
15    category: process_creation
16    product: macos
17detection:
18    selection:
19        Image|endswith: '/nscurl'
20        CommandLine|contains:
21            - '--download '
22            - '--download-directory '
23            - '--output '
24            - '-dir '
25            - '-dl '
26            - '-ld'
27            - '-o '
28    condition: selection
29falsepositives:
30    - Legitimate usage of nscurl by administrators and users.
31level: medium

References

Related rules

to-top