Curl Local File Read or Write via Osascript

[rule]
description = """
Detects when Curl is executed via Osascript and reads or writes to a local file. Threat actors will often use Curl to
download or upload files to a local file path on the system. The use of Curl via Osascript elevates the suspiciousness
of the activity as osascript is a scripting language that can be used to execute AppleScript commands. The combination
of these two activities is indicative of a threat actor attempting to download or upload a file on the system.
"""
id = "9abe2b65-10a9-4d7e-908b-d841d6c4b360"
license = "Elastic License v2"
name = "Curl Local File Read or Write via Osascript"
os_list = ["macos"]
reference = ["https://x.com/MsftSecIntel/status/1891410993265123662"]
version = "1.0.3"

query = '''
process where event.type == "start" and event.action == "exec" and process.name in ("curl", "nscurl") and 
 process.command_line : "*file://*" and process.parent.name == "osascript"
'''

min_endpoint_version = "8.16.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1105"
name = "Ingress Tool Transfer"
reference = "https://attack.mitre.org/techniques/T1105/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "8.16.0"