Sigma rule: Suspicious Installer Package Child Process

Rule

Title

Suspicious Installer Package Child Process

Status

test

Level

medium

Author

Sohan G (D4rkCiph3r)

Date

2023-02-18

File

rules/macos/process_creation/proc_creation_macos_installer_susp_child_process.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the execution of suspicious child processes from macOS installer package parent process. This includes osascript, JXA, curl and wget amongst other interpreters

Log source

product

macos

category

process_creation

Detection

selection_installer:
    ParentImage|endswith:
        - '/package_script_service'
        - '/installer'
    Image|endswith:
        - '/sh'
        - '/bash'
        - '/dash'
        - '/python'
        - '/ruby'
        - '/perl'
        - '/php'
        - '/javascript'
        - '/osascript'
        - '/tclsh'
        - '/curl'
        - '/wget'
    CommandLine|contains:
        - 'preinstall'
        - 'postinstall'
condition: selection_installer

False positives (as the rule lists them)

• Legitimate software uses the scripts (preinstall, postinstall)

Tags

• attack.t1059
• attack.t1059.007
• attack.t1071
• attack.t1071.001
• attack.execution
• attack.command-and-control

MITRE ATT&CK ids this rule names

• T1059
• T1059.007
• T1071
• T1071.001

References

• https://redcanary.com/blog/clipping-silver-sparrows-wings/
• https://github.com/elastic/detection-rules/blob/4312d8c9583be524578a14fe6295c3370b9a9307/rules/macos/execution_installer_package_spawned_network_event.toml

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/macos/process_creation/proc_creation_macos_installer_susp_child_process.yml