Potential XCSSET Malware Infection Indicators
This rule identifies execution traces indicative of the XCSSET macOS malware. XCSSET is known to spread via Xcode projects and maliciously modify applications. The rule looks for specific command-line patterns involving 'curl' to suspicious URLs, 'osacompile' and 'plutil' interacting with user and group containers, and 'zip' archiving data from user and group containers. These activities suggest potential command and control communication, persistence mechanisms, and data staging/exfiltration by the malware.
Sigma
