Elastic Defend high stable eql

Curl Execution via Apple Installer Package

Detects when curl is executed with the -o option and the effective parent process is an Apple installer process. Threat actors will utilize benign or backdoored software packages to download second stage payloads using curl in order to avoid detection and gain malicious code execution. An example of this activity is the nation state malware known as oRAT.

View Source

Detection Logic

process where event.type == "start" and 
  process.name in ("curl", "nscurl") and process.args in ("-o", "--output", "--download", "-dl", "-dir", "--directory") and
  process.Ext.effective_parent.name in ("installer", "package_script_service") and
  not process.args like ("https://agents.addigy.com/*", "https://pkg.devkitpro.org/packages/*")

Field Validations

Loading…

Comments (0)

Loading comments...