macOS Network Upload Activity

title: macOS Network Upload Activity
id: 379ef2f6-75a0-4ca8-8f2f-63eaa470489f
status: experimental
description: 'Detects execution of HTTP tools with upload methods (PUT, POST, --upload-file)

  which may indicate data exfiltration. Adversaries use curl/wget to upload stolen

  data to external servers or cloud storage.

  '
author: Eric Brown - Nebulock, Inc.
date: 2025/10/31
modified: 2025/10/31
references:
- https://attack.mitre.org/techniques/T1041/
- https://attack.mitre.org/techniques/T1567/
logsource:
  product: macos
  service: endpointsecurity
detection:
  selection_event:
    esf.event_type: 9
    event.action: exec
  selection_process:
    Image|endswith:
    - /curl
    - /wget
  selection_upload:
    CommandLine|contains:
    - --upload-file
    - '-T '
    - -X PUT
    - -X POST
    - --data
    - --data-binary
  condition: selection_event and selection_process and selection_upload
falsepositives:
- Legitimate API interactions and data submissions
- Software updates and telemetry uploads
- Development and testing activities
- Automated system reporting
fields:
- Image
- CommandLine
- ProcessId
- ParentProcessId
- User
tags:
- attack.exfiltration
- attack.t1041
- attack.t1567
level: medium