Skip to content

Hide Navigation Hide TOC

Suspicious Installer Package Child Process (e0cfaecd-602d-41af-988d-f6ccebb2af26)

Detects the execution of suspicious child processes from macOS installer package parent process. This includes osascript, JXA, curl and wget amongst other interpreters

Cluster A Galaxy A Cluster B Galaxy B Level
Suspicious Installer Package Child Process (e0cfaecd-602d-41af-988d-f6ccebb2af26) Sigma-Rules Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830) Attack Pattern 1
Suspicious Installer Package Child Process (e0cfaecd-602d-41af-988d-f6ccebb2af26) Sigma-Rules Web Protocols - T1071.001 (df8b2a25-8bdf-4856-953c-a04372b1c161) Attack Pattern 1
Suspicious Installer Package Child Process (e0cfaecd-602d-41af-988d-f6ccebb2af26) Sigma-Rules JavaScript - T1059.007 (0f4a0c76-ab2d-4cb0-85d3-3f0efb8cba0d) Attack Pattern 1
Suspicious Installer Package Child Process (e0cfaecd-602d-41af-988d-f6ccebb2af26) Sigma-Rules Application Layer Protocol - T1071 (355be19c-ffc9-46d5-8d50-d6a036c675b6) Attack Pattern 1
Web Protocols - T1071.001 (df8b2a25-8bdf-4856-953c-a04372b1c161) Attack Pattern Application Layer Protocol - T1071 (355be19c-ffc9-46d5-8d50-d6a036c675b6) Attack Pattern 2
Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830) Attack Pattern JavaScript - T1059.007 (0f4a0c76-ab2d-4cb0-85d3-3f0efb8cba0d) Attack Pattern 2