Elastic high stable eql

Suspicious Curl to Jamf Endpoint

Detects curl requests to JAMF Pro endpoints from suspicious processes like unsigned binaries or scripting interpreters. This indicates potential abuse of stolen JAMF credentials for lateral movement in enterprise macOS environments.

View Source

Detection Logic

process where host.os.type == "macos" and event.type == "start" and event.action == "exec" and
  process.name in ("curl", "nscurl") and process.command_line like "*https://jamf.*" and
  ((process.parent.code_signature.exists == false or process.parent.code_signature.trusted == false) or
   process.parent.name in ("osascript", "node", "perl", "ruby") or
   process.parent.name like "python*")

Field Validations

Loading…

Comments (0)

Loading comments...