Sigma rule: Potential XCSSET Malware Infection

Rule

Title

Potential XCSSET Malware Infection

Status

test

Level

medium

Author

Tim Rauch (rule), Elastic (idea)

Date

2022-10-17

File

rules/macos/process_creation/proc_creation_macos_xcsset_malware_infection.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Identifies the execution traces of the XCSSET malware. XCSSET is a macOS trojan that primarily spreads via Xcode projects and maliciously modifies applications. Infected users are also vulnerable to having their credentials, accounts, and other vital data stolen.

Log source

product

macos

category

process_creation

Detection

selection_1_curl:
    ParentImage|endswith: '/bash'
    Image|endswith: '/curl'
    CommandLine|contains:
        - '/sys/log.php'
        - '/sys/prepod.php'
        - '/sys/bin/Pods'
selection_1_https:
    CommandLine|contains: 'https://'
selection_other_1:
    ParentImage|endswith: '/bash'
    Image|endswith: '/osacompile'
    CommandLine|contains|all:
        - '/Users/'
        - '/Library/Group Containers/'
selection_other_2:
    ParentImage|endswith: '/bash'
    Image|endswith: '/plutil'
    CommandLine|contains|all:
        - 'LSUIElement'
        - '/Users/'
        - '/Library/Group Containers/'
selection_other_3:
    Image|endswith: '/zip'
    CommandLine|contains|all:
        - '-r'
        - '/Users/'
        - '/Library/Group Containers/'
condition: all of selection_1_* or 1 of selection_other_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.command-and-control

References

• https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-f5deb07688e1a8dec9530bc3071967b2da5c16b482e671812b864c37beb28f08
• https://malpedia.caad.fkie.fraunhofer.de/details/osx.xcsset

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/macos/process_creation/proc_creation_macos_xcsset_malware_infection.yml