Potential In-Memory Download And Compile Of Payloads (XCSSET)

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•27

This rule detects the execution of 'osacompile' and 'curl' in the same command line. This combination is indicative of in-memory downloading and compiling of applets, a technique observed in the XCSSET malware. 'curl' is used to download content, and 'osacompile' is used to compile AppleScript or JavaScript for Automation (JXA) scripts, which can then be executed.