Detection rules › Sigma
macOS ESF Suspicious Curl Download
Detect curl execution fetching remote content which is often used by installers or scripts. Requires curl/wget/fetch to be the executing process.
Known false positives
- legitimate software updates or admin usage
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Command & Control | No specific technique |
Rule body
title: macOS ESF Suspicious Curl Download
id: 9d3885a1-0b3e-4e07-bd1d-0897b6f75819
status: experimental
description: Detect curl execution fetching remote content which is often used by
installers or scripts. Requires curl/wget/fetch to be the executing process.
author: Eric Brown - Nebulock, Inc.
date: 2025-10-29
logsource:
product: macos
service: endpointsecurity
level: medium
detection:
selection_event:
esf.event_type: 9
event.action: exec
selection_process:
Image|endswith:
- /curl
- /wget
- /fetch
selection_cmd:
CommandLine|contains:
- http://
- https://
- ftp://
condition: selection_event and selection_process and selection_cmd
falsepositives:
- legitimate software updates or admin usage
tags:
- attack.command_and_control
modified: 2025/01/15
Stages and Predicates
Stage 0: condition
selection_event and selection_process and selection_cmdStage 1: selection_event
selection_event:
esf.event_type: 9
event.action: exec
Stage 2: selection_process
selection_process:
Image|endswith:
- /curl
- /wget
- /fetch
Stage 3: selection_cmd
selection_cmd:
CommandLine|contains:
- http://
- https://
- ftp://
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
CommandLine | match |
| field:"CommandLine" kind:match |
Image | ends_with |
| field:"Image" kind:ends_with |
esf.event_type | eq |
| field:"esf.event_type" kind:eq value:"9" |
event.action | eq |
| field:"EventType" kind:eq value:"exec" |