Curl Output Piped to Osascript

[rule]
description = """
Detects when curl or nscurl is executed followed by osascript execution within 15 seconds from the same parent process.
This pattern indicates potential malicious workflows where curl output is being piped to osascript for AppleScript
execution, commonly used for payload downloads and immediate execution or C2 communication.
"""
id = "d8a84851-53ac-42ba-8c41-dd16fda7e9da"
license = "Elastic License v2"
name = "Curl Output Piped to Osascript"
os_list = ["macos"]
version = "1.0.4"

query = '''
sequence by process.parent.entity_id with maxspan=20s
[process where event.type == "start" and event.action == "exec" and
  process.name in ("curl", "nscurl") and process.parent.name in ("bash", "sh", "zsh")]
[process where event.type == "start" and event.action == "exec" and 
  ((process.args == "osascript" and process.args == "-l" and process.args == "JavaScript" and process.args_count == 3) or 
   (process.args == "osascript" and process.args_count == 1))]
'''

min_endpoint_version = "8.16.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.002"
name = "AppleScript"
reference = "https://attack.mitre.org/techniques/T1059/002/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1105"
name = "Ingress Tool Transfer"
reference = "https://attack.mitre.org/techniques/T1105/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "8.16.0"