File Download Via Nscurl - MacOS

SigmaHQ Detections@sigmaHQ

•updated Apr 16, 2025•1•0•30

Detects the execution of the `nscurl` utility on macOS with command-line arguments indicative of file download operations. This can be used by adversaries to transfer tools or other files into a compromised environment.