File Download Via Nscurl - MacOS

Title: File Download Via Nscurl - MacOS
Status: test
Description:Detects the execution of the nscurl utility in order to download files.
References:
  -https://www.loobins.io/binaries/nscurl/
  -https://www.agnosticdev.com/content/how-diagnose-app-transport-security-issues-using-nscurl-and-openssl
  -https://gist.github.com/nasbench/ca6ef95db04ae04ffd1e0b1ce709cadd
Author: Daniel Cortez
Date: 2024-06-04
modified:None
Tags:

• -'attack.command-and-control'
• -'attack.t1105'

Logsource:

• category: process_creation
• product: macos

Detection:
  selection:
    Image|endswith: '/nscurl'
    CommandLine|contains:
      -'--download '
      -'--download-directory '
      -'--output '
      -'-dir '
      -'-dl '
      -'-ld'
      -'-o '

  condition:selection
Falsepositives:
  -Legitimate usage of nscurl by administrators and users.
Level: medium