BIOC
Informational
✕
Microsoft Office spawns curl/wget on a macOS device
Microsoft Office Word/Excel/PowerPoint/Outlook spawn wget/curl on a macOS device.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Exfiltration
- Status:
- Enabled
ATT&CK tactics: Exfiltration (TA0010)
ATT&CK techniques: Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol (T1048.003)
Indicator:
Process action type = execution AND target process name = curl , wget Process initiated by = Microsoft Excel , Microsoft Word , Microsoft PowerPoint , Microsoft Outlook , cgo name = Microsoft Excel , Microsoft Word , Microsoft PowerPoint , Microsoft Outlook , os parent name = Microsoft Excel , Microsoft Word , Microsoft PowerPoint , Microsoft Outlook
Preventable: yes