Detection rules › Sigma
Process Signal from Suspicious Parent Process
Detects signals sent from processes that don't typically manage other processes
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | T1059 Command and Scripting Interpreter |
Rule body yaml
title: Process Signal from Suspicious Parent Process
id: f21b167a-1111-4b33-bff4-b1e4bd4459a8
status: experimental
description: Detects signals sent from processes that don't typically manage other
processes
references:
- https://attack.mitre.org/techniques/T1059/
author: Eric Brown - Nebulock, Inc.
date: 2025/10/29
tags:
- attack.execution
- attack.t1059
logsource:
product: macos
service: endpointsecurity
category: process_signal
detection:
selection_signal:
esf.event_type: 27
event.action: signal
selection_suspicious:
Image|endswith:
- /curl
- /wget
- python
- ruby
- perl
- osascript
condition: selection_signal and selection_suspicious
falsepositives:
- Scripts and automation tools
- Development activities
level: medium
modified: 2025/01/15
Stages and Predicates
Stage 0: condition
selection_signal and selection_suspiciousStage 1: selection_signal
selection_signal:
esf.event_type: 27
event.action: signal
Stage 2: selection_suspicious
selection_suspicious:
Image|endswith:
- /curl
- /wget
- python
- ruby
- perl
- osascript
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
Image | ends_with |
|
esf.event_type | eq |
|
event.action | eq |
|