Elastic Defend high stable eql
Curl Executable File Download via Osascript
Detects the execution of curl via osascript with the "-o" argument indicating a file download. This activity should be highly abnormal and considered suspicious at least. Threat actors have consistently been seen utilizing this technique to establish C2 or download additional payloads / tools.
Detection Logic
file where event.action == "modification" and file.Ext.header_bytes like~ ("cffaedfe*", "cafebabe*") and
process.name in ("curl", "nscurl") and Effective_process.name == "osascript"Field Validations
Loading…
Comments (0)
Loading comments...