Detection rules › Sigma

Process Signal from Suspicious Parent Process

Status
experimental
Severity
medium
Log source
product macos, category process_signal, service endpointsecurity
Author
Eric Brown - Nebulock, Inc.
Source
github.com/Nebulock-Inc/macos-coresigma

Detects signals sent from processes that don't typically manage other processes

MITRE ATT&CK coverage

Rule body yaml

title: Process Signal from Suspicious Parent Process
id: f21b167a-1111-4b33-bff4-b1e4bd4459a8
status: experimental
description: Detects signals sent from processes that don't typically manage other
  processes
references:
- https://attack.mitre.org/techniques/T1059/
author: Eric Brown - Nebulock, Inc.
date: 2025/10/29
tags:
- attack.execution
- attack.t1059
logsource:
  product: macos
  service: endpointsecurity
  category: process_signal
detection:
  selection_signal:
    esf.event_type: 27
    event.action: signal
  selection_suspicious:
    Image|endswith:
    - /curl
    - /wget
    - python
    - ruby
    - perl
    - osascript
  condition: selection_signal and selection_suspicious
falsepositives:
- Scripts and automation tools
- Development activities
level: medium
modified: 2025/01/15

Stages and Predicates

Stage 0: condition

selection_signal and selection_suspicious

Stage 1: selection_signal

selection_signal:
  esf.event_type: 27
  event.action: signal

Stage 2: selection_suspicious

selection_suspicious:
  Image|endswith:
  - /curl
  - /wget
  - python
  - ruby
  - perl
  - osascript

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Imageends_with
  • /curl
  • /wget
  • osascript
  • perl
  • python
  • ruby
esf.event_typeeq
  • 27
event.actioneq
  • signal