Elastic Defend high stable eql

Potential Payload Download via AppleScript Applet

Identifies activity where an AppleScript applet is executed followed by the immediate execution of the "curl" command. An attacker might use an AppleScript applet to automate malicious tasks and leverage "curl" to download additional payloads or communicate with a command and control (C2) server. This activity has been observed being utilized by XCSSET and more recently by a new threat deemed "Rustbucket" by JAMF to bypass Gatekeeper and download a second stage payload.

View Source

Detection Logic

process where event.type == "start" and 
  process.name in ("curl", "nscurl") and
  (process.Ext.effective_parent.name == "applet" or process.parent.name == "applet") and
  not process.args like "POST"

Field Validations

Loading…

Comments (0)

Loading comments...